4 ms·
Exactly this. Vrchat had chromium for a while, but exploits got it removed. Itd be great if it was just a static browser engine, no Js, with a strong sandbox. S
by devwastaken 6y ago
Exactly this. Vrchat had chromium for a while, but exploits got it removed. Itd be great if it was just a static browser engine, no Js, with a strong sandbox. So at most all that can be done is messing with the browsers runtime memory itself, not the system it's on.
- mhh__ 6y agoWhat kind of exploits? Was the browser not isolated at all or was it (say) sandbox-escaping via the JS?
- deleted 6y ago[deleted]
- dleslie 6y agoWe posted this: https://medium.com/@vrchat/security-update-web-panels-4699fa0be103 https://medium.com/@vrchat/security-update-web-panels-4699fa... It was severe enough that I ripped them out, though we were unable to find any evidence of the vulnerability in use.
- mmmkkaaayy 6y agoBut what was the vulnerability? It's not mentioned in the post.
- dleslie 6y agoIt's been a few years, and I can't recall the specifics with certainty. It was a serious Chromium SVE that was unpatched in the middleware we were using.
- dleslie 6y agoHeh, that's why I asked. I'm one of the developers of VRChat.