4 ms·
Generally code execution within browser/client-side javascript sandbox is just "XSS". RCE usually implies server-side code execution (or breaking out of browse
by collinmanderson 10mo ago
Generally code execution within browser/client-side javascript sandbox is just "XSS".
RCE usually implies server-side code execution (or breaking out of browser sandbox).
- llmslave2 10mo agoHmm, I've always thought of "RCE" in a more general way, regarding the ability to execute arbitrary code on a computer you don't own. For example some multiplayer games have had exploits that let hosts run arbitrary code on clients that connect to them, and I've seen that called an RCE vulnerability. shrugs
- collinmanderson 10mo agoIf it’s running code outside of a normal browser sandbox then, yes it’s a RCE. Because it can now access to nearly everything on the user’s computer, including their browser, email, etc. XSS is limited to accessing just that one website.