3 ms·

Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p

Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Rest easy

nolist_policy 2y ago
I have trouble parsing your "Rest easy". Yes, many of these vulns are memory corruption and then remote code execution. So what? The attacker is still confined to the sandboxed process.
- medo-bear 2y ago
  If 90% of your activity is in the browser, then even if your sandbox was 100% isolated from other processes, 90% of your activity is still exposed, no? And why are you confident in sandboxing? Just like in real life, it is only a rudimentary defence. Here is some more browser goodness https://www.theverge.com/2023/11/30/23982296/google-chrome-browser-update-sandbox-escape-exploit-security-vulnerability https://www.theverge.com/2023/11/30/23982296/google-chrome-b... Rest easy. Although I truly hope you are not in charge of anyone's IT sec
  - nolist_policy 2y ago
    Every browser tab has its own sandboxed process. And to top it off, at least in Chrome every site (second-level domain) and iframe has its own sandboxed process.
    - medo-bear 2y ago
      With so many escape issues the term sandboxed browser is a little more than a marketing phrase https://github.com/allpaca/chrome-sbx-db https://github.com/allpaca/chrome-sbx-db Rest easy
      - nolist_policy 2y ago
        Nice list. Now you need a RCE exploit and a chained breakout exploit thought. That's a lot of cash. Given this and that the process isolation also protects against meltdown/spectre type attacks, I think we can agree that this type of fine-grained sandboxing is a requirement for secure software, no? However, next to no software is using fine-grained sandboxing. From the top of my head only qmail, djbdns and gatling come to mind, none of them are for end-users. So what end-users software does actually approach or surpas browsers in this regard?
        medo-bear 2y ago
        Then lets not pretend that a browser is sufficiently secure for people considering using OpenBSD. Given the fact that by its nature a browser runs untrusted unreviwed code on your device it does a pretty good job of making it difficult to exploit, but it is irresponsible to say that its sandboxing cant be bypassed when clearly it can.

nolist_policy 2y ago

I have trouble parsing your "Rest easy". Yes, many of these vulns are memory corruption and then remote code execution. So what? The attacker is still confined to the sandboxed process.

medo-bear 2y ago
If 90% of your activity is in the browser, then even if your sandbox was 100% isolated from other processes, 90% of your activity is still exposed, no? And why are you confident in sandboxing? Just like in real life, it is only a rudimentary defence. Here is some more browser goodness https://www.theverge.com/2023/11/30/23982296/google-chrome-browser-update-sandbox-escape-exploit-security-vulnerability https://www.theverge.com/2023/11/30/23982296/google-chrome-b... Rest easy. Although I truly hope you are not in charge of anyone's IT sec
- nolist_policy 2y ago
  Every browser tab has its own sandboxed process. And to top it off, at least in Chrome every site (second-level domain) and iframe has its own sandboxed process.
  - medo-bear 2y ago
    With so many escape issues the term sandboxed browser is a little more than a marketing phrase https://github.com/allpaca/chrome-sbx-db https://github.com/allpaca/chrome-sbx-db Rest easy
    - nolist_policy 2y ago
      Nice list. Now you need a RCE exploit and a chained breakout exploit thought. That's a lot of cash. Given this and that the process isolation also protects against meltdown/spectre type attacks, I think we can agree that this type of fine-grained sandboxing is a requirement for secure software, no? However, next to no software is using fine-grained sandboxing. From the top of my head only qmail, djbdns and gatling come to mind, none of them are for end-users. So what end-users software does actually approach or surpas browsers in this regard?
      - medo-bear 2y ago
        Then lets not pretend that a browser is sufficiently secure for people considering using OpenBSD. Given the fact that by its nature a browser runs untrusted unreviwed code on your device it does a pretty good job of making it difficult to exploit, but it is irresponsible to say that its sandboxing cant be bypassed when clearly it can.