3 ms·
It looks like this is not an actual exploit, but a hole in the sandbox that first requires injecting custom code into the process?
by etaioinshrdlu 6y ago
It looks like this is not an actual exploit, but a hole in the sandbox that first requires injecting custom code into the process?
- albntomat0 6y agoI guess it depends on how you define "exploit." I'd personally consider bypassing the sandbox an exploit, even though it's not a full chain.
- dathinab 6y agoIn the end the sandbox is there to provide some limited security even in presence of other vulnerabilities. So I would say it's a security critical bug a sandbox escape and a building blog for an exploit but not a exploit by itself. Anyway it's sill a security vulnerability.
- kevingadd 6y agoAll the big browser attacks require exploit chains, and this is a component for creating an exploit chain. The best exploit chains can go all the way from a web page's JS to complete root access (this was achieved on Chromebooks at one point in the last couple years, using webassembly as one of the hops in the chain)
- tiraniddo 6y agoIt’s an proof of concept exploit for a vulnerability in the sandbox used by FF which is a security boundary to reduce the impact of RCE. The reason for the injection is I don’t just have a working RCE lying around (we get them fixed) and using one would add additional complications and obfuscate the bug when reporting. The purpose of a proof of concept is to demonstrate impact so that it can be fixed.