9 ms·

Are we forgetting that Chrome had a zero-day literally three months ago? https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-

Are we forgetting that Chrome had a zero-day literally three months ago? https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-day-cve-2019-5786/ https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/... > Google is aware of reports that an exploit for CVE-2019-5786 exists in the wild.

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
icebraining 7y ago
While I'm a Firefox user, that's actually evidence to xtalh's point: that bug by itself is useless, because Chrome's sandbox meant that taking over the rendering process is not enough. They only managed to escape on Windows 7, thanks to another bug (in Windows itself - CVE-2019-0808).
- pcwalton 7y ago
  Note that Firefox has a sandbox too (in fact, it shares a good bit of code with that of Chrome), and therefore a sandbox escape is necessary to elevate privileges. (NB: I have no knowledge of the details of this specific bug.)
- laughinghan 7y ago
  Leaving aside whether it makes sense to call something "useless" that was actually used in the wild, the original article specifically mentions (twice) that the Firefox RCE 0-day was also sandboxed and also only managed to escape thanks to another 0-day. (And I'm actually a Chrome user, for now.)