6 ms·
Actively exploited sandbox RCE in all Chromium versions
- petra303 22d agoOnly a score of 8.8?
- teravor 22d agoRCE inside sandbox, so requires chaining with another 0day.
- zahlman 21d agoWhat exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?
- jnwatson 21d agoIt means it can execute arbitrary machine code in the sandbox.
- zahlman 21d agoOkay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?
- r_lee 21d agobecause with proper code exec you can trigger other bugs to escalate beyond the sandbox, whereas with JS you'd have to find a bug to escape from JS to native can't get a proper ios/Android RCE with just JS code exec
- p-e-w 21d agoIt can do some things that JS can’t do, such as invalid pointer writes. But you are correct that this doesn’t automatically imply system access.
- insanitybit 21d agoBecause Javascript theoretically can't just access files on disk. Control over the render would let you do that, if not for the process level sandbox, which constraints things like file access, system, calls, etc. But the process is still more capable than the VM. The process can talk to other processes via IPC, for example. That's why you don't go from "javascript -> computer is taken over", instead you go from "javascript -> renderer control -> computer is taken over".
- arcfour 21d agoAmong other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and upload all of the files" or "spawn cmd.exe on the user's machine". How would you even do these things if you could run any JavaScript in the browser? You can't. However, chrome.exe itself does because it's a native application, as is the sandboxed JavaScript interpreter inside of chrome.exe. (This is a very oversimplified explanation but I think this is the disconnect people are having)
- bawolff 21d ago> JavaScript in the browser has no way to even express ... "list the contents of `C:\Users\Documents` and upload all of the files" this is besides the point, but javascript has the file system api. anyways to your broad point, i dont think this is convincing. What's the difference between not having an api vs having an api that is disabled (e.g. the syscall exists but is filtered). Either way you are not taking the action. RCE in the sandbox is an important step in the bigger exploit chain, but not because you can express things in the traditional syscalls inside the sandbox.
- zahlman 21d agoOkay, but we're still talking about running machine code inside the sandbox, where that functionality is still not available.
- arcfour 21d agoThe functionality is restricted, but the capability of expressing the intent at all exists.
- r_lee 21d agoI think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.
- ranger_danger 21d agoSeems to use OS-specific kernel syscall filtering facilities. Windows: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md#The-integrity-levels https://chromium.googlesource.com/chromium/src/+/HEAD/docs/d... Linux: https://chromium.googlesource.com/chromium/src/+/0e94f26e8/docs/linux_sandboxing.md https://chromium.googlesource.com/chromium/src/+/0e94f26e8/d...
- r_lee 21d agogreat link, thanks
- Genwald 21d agoV8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear. https://chromium.googlesource.com/v8/v8.git/+/refs/heads/main/src/sandbox/README.md https://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...
- insanitybit 21d agoI would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.
- TacticalCoder 21d ago> It means it can execute arbitrary machine code in the sandbox. Well which is precisely why we have sandboxes. To me "executing arbitrary code in the sandbox" is similar to "I don't give a flying fuck for it's what a sandbox is for". More information is needed. As someone commented: this has to be paired with at least another exploit to make anything remotely useful. A sandbox is a sandbox. We want to understand how "code running in a sandbox" is "actively exploited".
- deleted 21d ago[deleted]
- johnsmith1840 21d agoMemory isolation having one tab or account open on your bank and another on this page does not mean it could leak across the sandbox and steal bank account details but anything inside of your general page content can be lost
- deleted 21d ago[deleted]
- jimrandomh 21d agoIt means it can execute native code inside the sandbox, as opposed to Javascript. While still sandboxed, this lets it access some parts of the attack surface that JS would not have been able to, some of which may have other exploits that allow escaping the rest of the way.
- StilesCrisis 21d agoChrome runs webpages in individual sandbox processes with very low privileges, as a defense-in-depth strategy. It generally requires at least two exploits to actually affect a user--first, get RCE in a sandboxed process, then find a separate vulnerability that lets you escape the sandbox process entirely. For this bug to have actually been used in the wild, there was almost certainly a second bug as well.
- iririririr 21d agowhat is online ad networks for $100, alex
- deleted 21d ago[deleted]
- jeremyjh 21d agoI don't know why this is being downvoted. This is called malvertising and its one of the most significant vectors for exploiting a vulnerability like this. Its happened multiple times over the last two decades. My read of Google's disclosure is that there is likely no known escape from the sandbox. I don't agree this would be reported this way just because "user action" like "using web browser" is required. Even if this individual CVE is correctly an 8.8 there would be a critical assessment of a known chain. The only reason there wouldn't be, would be if the other vulnerability is known to Google but has no patch yet.
- TZubiri 21d agoThis doesn't affect the score though, the reason there's 1.2 points less than the max is because there is a Required User Interaction. The user needs to visit a specific html page. Even with the sandbox protection layer, the rest of the parameters are maxed out.
- Cider9986 22d agoBrave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.
- chuckadams 21d agoThe release version just now updated to 152.0.7977.83 which has the fix.
- fmajid 21d agoI upgraded Vivaldi, which is reporting 152.0.7977.112
- deleted 21d ago[deleted]
- anon109 21d agoIs graphene even affected? JIT is disabled in default configurations.
- drewfax 20d agoThat's how the system or browser should be configured. Secure by default and any insecurity must be an opt-in. But Google won't do it because their websites are JS heavy monster trucks and millions of websites run their tracking scripts which require JIT enabled by default for optimal page load.
- d2kx 21d agoThis issue is already fixed in Google Chrome (152.0.7977.83)
- azakai 21d agoTFA says > Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. So it was fixed in 152.0.7977.82 (before .83), if I read that right.
- Terr_ 21d agoAs somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising. "Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."
- TZubiri 21d agoThis seems irrelevant as the issue talks about being exploitable with a crafted HTML page, no mention of JS. If true, you would be able to be hit without js enabled.
- krackers 21d agoIt mentions a type confusion in V8. Is it possible to trigger that without JS enabled? The "all chromium versions" part of the title is also misleading, most browser CVEs do not distinguish between "untested lower bound" vs "affects all" (even though it seems like it'd be trivial to bisect).
- colincowardly 21d ago[dead]
- anonymousiam 21d agoJust one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.
- lta 21d agoIf we needed any more.
- Barbing 21d agoOf all the reasons to use non-Chromium browsers whenever possible(!), this isn’t really on the list.
- lima 21d agoWhich browser has a better security track record?
- Cider9986 21d agoVanadium makes improvements on Chromium. https://grapheneos.org/features#vanadium https://grapheneos.org/features#vanadium
- esseph 21d agoRight, but it's value-add on a derivative, not its own standalone engine.
- StilesCrisis 21d agoMost of those are just changing flags, not really unique development. Like "disable JIT" is a Chromium flag. "Zero-init everything" is a Clang flag.
- LiamPowell 21d agoIt's not even a build flag, it's a setting that you can just go and enable in Chrome's own settings menu (chrome://settings/content/v8).
- david_shaw 21d agoLet's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild? Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency? It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.
- CookieCrisp 21d agoWhile I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?
- teravor 21d agoideally, an auction and the vendor or a government can bid against malicious actors (which can also be a government). hard to set up though.
- thenewnewguy 21d agoDoes anybody have a source for the "actively exploited" part of the HN title?
- crtasm 21d agoThis line, I think? >This CVE is in CISA's Known Exploited Vulnerabilities Catalog
- esseph 21d ago"Google has confirmed that an exploit exists in the wild but has not disclosed information about the threat actors, targeted organizations, or attack campaigns while the update is still rolling out."
- john_strinlai 21d agoby nature of being in the "known exploited vulnerabilities catalog" (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85046 https://www.cisa.gov/known-exploited-vulnerabilities-catalog...) "CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild."
- publlus_enigma 21d agoNormalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.
- eru 21d agoIn the future we can ask that your JaveScript and Wasm comes with a proof of being benign.
- valleyer 21d agoPrior art: the evil bit https://datatracker.ietf.org/doc/html/rfc3514 https://datatracker.ietf.org/doc/html/rfc3514
- muvlon 21d agoWhat would that even look like? What is "benign"? The browser environment already has pretty strict rules for what the JS can do. It's not allowed to read your files, see your webcam without permission, know about other tabs or windows etc. The problem here is that the browser failed to correctly implement those rules. If the chromium team cannot do that, what makes you think they can implement any other kind of "benign code" verification with zero bugs?
- eru 20d ago
- basilikum 21d agoFor what is this exploited in the wild when it doesn't include a sandbox escape? Is this chained with n-days?
- sebstefan 21d agoIf it's in the CISA known exploited vulnerabilities catalog, tell me if I'm wrong but I assume people don't go around exploiting million dollar 0-days in public just to fuck around safely in a chrome sandbox. So maybe we're going to see another CVE for the sandbox escape soon?
- daveguy 21d agoCrypto mining would be one application. But also, combined with a sandbox escape would make it particularly devastating. Usually full control of a device takes at least two exploits given the layers of security present in OS and browser environments.
- pizlonator 21d agoThere's a risk that someone had been sitting on a sandbox escape that assumed having RCE inside the sandbox first, and so they'd been waiting for an RCE exactly like this one. Those folks would not be disclosing their sandbox escape unless they were good guys. (Posted with a memory safe WebKit, Fil-C FTW)
- pizdocalmin 21d ago[flagged]
- oynqr 21d agoYou should add a disclaimer that you are the CEO of Fil-C. /s In the context of this vulnerability, I doubt memory safety would have made much of a difference. This is a great reminder though, currently doing a full userspace replacement on my 3D printer and Fil-C might be just what I need for the irreplaceable C parts.
- 21d ago
- throwatdem12311 21d agoI’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.
- jesse_dot_id 21d agoThere's been a Chrome CVE like every week ever since it came out.
- iammrpayments 21d agoThey just released a CVE for a garbage truck vulnerability where an attacker could brick the vehicle by exploiting the telemetry system these things now have preinstalled in factory.
- jdironman 21d agoSounds like much needed downtime for the person slinging the garbage then.
- Sha1rholder 21d agoDon't. Garbage Collector hurts your memory
- neogodless 21d agoSometimes you want nothing more than to make room for new memories.
- throwatdem12311 21d agoI kinda want to just forget things though.
- dgellow 21d agoGC doesn’t hurt, you just need to stop the world, do a cleanup, and you’re good to go :)
- tclancy 21d ago
- TZubiri 21d agoWhy is this 8.8? It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction. Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.
- snorbleck 21d agoSo basically, Edge, Brave and any other browser built on Chromium. Nice.
- anonymars 21d agoMonocultures are great!
- strenholme 21d agoThere’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs. I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.
- tkot 21d agoIs Firefox actually safer than Chromium-based browsers though? I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.html#security-researcher-views https://madaidans-insecurities.github.io/firefox-chromium.ht... but has the situation changed substantially in favor of Firefox?
- armadyl 21d agoNo. The post applies to Android, but the situation is significantly worse on desktop platforms since Android at least has OS-level sandboxing, etc. https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial_response_to_a_blog_post_claiming_to/ https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial...
- strenholme 21d agoIt looks like more of Firefox has been ported over to Rust since then: https://www.wilderssecurity.com/threads/security-chromium-versus-firefox.450867/#post-3136787 https://www.wilderssecurity.com/threads/security-chromium-ve... The reason why I support Gecko and Ladybird’s engine is because I am opposed to monoculture, however. Even if Gecko (Firefox) is less secure than Chromium (Chrome, Edge, etc.), by not having a monoculture, a Chrome exploit will only take down the subset of people using the Chromium ecosystem, and not affect Gecko users. Alas, most people are in the Chromium ecosystem right now so that means malicious hackers only need to target one codebase. It’s the same reason I wrote MaraDNS back in 2001—back then, there was only one open source DNS server[1,2] so I wrote another one.[3] [1] Djbdns was around back then but wasn’t open source, which limited its adoption. [2] https://lwn.net/2001/0208/ https://lwn.net/2001/0208/ [2] MaraDNS was and is optimized for running at most a few dozen domains on a system running a bunch of other services, where one does not want the DNS server causing security problems for the server, and where the DNS server needs to be lightweight as possible.
- johnnyApplePRNG 21d agoNIST probably had this one filed and ready to announce years ago like those news agencies have obituaries of famous old people pre-written
- edoceo 21d agoI know a regular old geezer who's written his own obituary. Publish this when I die. I bet famous people have their people write one to distribute immediately. Also, writing those for your family sucks, easier to do it when they are alive and can tell some key stories.
- radium3d 21d agoDoesn't everyone else immediately update everything on their computer before they start doing anything?
- Invictus0 21d agowhat planet are you living on
- throawayonthe 21d agothat feels pretty table-stakes no?
- chrisjj 21d agoIs that frequent enough? I mean an update might be issued after you start doing something.
- mamzxcvbn779807 21d ago[dead]
- deleted 21d ago[deleted]
- jewsdienow 21d ago[dead]
- pizlonator 21d agoSounds wild. (Posted from memory safe WebKit; i.e. WebKit compiled with filcc and all of WebKit's dependencies compiled with filcc.)
- krackers 21d agoFor it to be memory safe, do you have to disable the JIT?
- pizlonator 21d agoYeah
- amluto 21d agoIt sounds technically possible to build a JIT where a verifier checks that the JIT-generated code is correctly pizlonated before allowing it to become executable. :)
- pizlonator 21d agoYes I have a new tech called SaRCAsm, which is a memory-safe assembler. So the next step is a "Sarcastic JIT" :-)
- Ohentis 21d agoI think it makes more sense to verify that the jit is correct than to verify that it's output is correct at runtime.
- pizlonator 21d agoNah It's damn near impossible to verify that the JIT is correct. But it is possible to verify at runtime that the code that the JIT emitted obeys some memory safety law. (V8's heap sandbox is an example of this; a sarcastic JIT would be an arguably stronger example of this.)
- jewsdienow 21d ago[dead]
- Animats 21d agoChromium, or just Chrome?
- deleted 21d ago[deleted]
- jewsdienow 21d ago[flagged]
- DANmode 21d agoIt’s not. Same as credible threats are also seen as nothing to do with free speech. It just isn’t what free speech is. It’s a separate thing.
- fc417fc802 21d agoNo, it is a limit on free speech but it is one of several that various governments (and cultures as a whole) throughout the world have upheld fairly consistently. Free speech is more or less an unachievable platonic ideal that we aspire to. Success varies, as do the compromises made along the way. Speaking more generally, don't let your ideals bias your judgment. Just because you support policy X and also view ideal Y as good that doesn't mean that X isn't detrimental to Y. It's important to be objective about these things.
- DANmode 19d ago> Free speech is more or less an unachievable platonic ideal that we aspire to I’m almost certain it’s shorthand for “freedom of expression”, which most reasonable people throughout history have not grouped threats of violence into. In fact, they’ve done violence in return, historically, in response to credible threats, and some jurisdictions uphold that legal right. So, it truly has nothing to do with my ideals.
- fc417fc802 19d agoI'd counter that freedom of expression is either equivalent to or a superset of freedom of speech. The specifics are purely an argument of semantics and thus most likely uninteresting and not worthwhile. Most reasonable people throughout history have not attempted to defend any sort of blanket right to make threats of violence in any and all circumstances, I obviously agree with you there. My point was that this is clearly a restriction on the freedom to express oneself. I don't know how to articulate my reasoning here any further because the meaning is about as literal as you can get. A threat of violence is most certainly an expression made by an individual after all. It isn't always desirable or even possible to achieve a platonic ideal that we otherwise generally recognize as being good to strive for. However pretending that we aren't making carveouts leads to muddy thinking and paves the way for abuses.
- vilas900420 21d ago[flagged]
- pertique 21d agoNot to downplay the severity (patch your browsers!), but there have been 5-10 actively-exploited V8 type confusion vulnerabilities in the last year. I'd be curious if this one blew up because it was the only one that was posted, or if it barely crossed some line in the collective consciousness this time around.
- RA2lover 21d agoI think it's the first one where the Chrome version fixing it has no Manifest V2 support at all.
- mikeweiss 21d agoIsn't this exactly why there is a sandbox? What can the RCE actually do or obtain within the sandbox?
- deleted 21d ago[deleted]
- socalgal2 21d agoYes, it says right in the CVE > allowed a remote attacker to execute arbitrary code *inside the sandbox*
- mikeweiss 21d agoSo then what's the big deal? If you had JavaScript turned off it would allow code to run in the sandbox anyway?
- nikanj 21d agoDoesn’t any <script> tag let you run arbitrary code inside a sandbox anyway?
- lima 20d agoInside the JS sandbox, not the browser's outer containment sandbox.
- b8 21d ago$1k for this vuln is laughable. If the researcher wrote an exploit as the nday exploit devs did and sold it in the gray market they would of got significantly more.
- roschdal 21d ago[flagged]
- turpentine 21d agoWhat does your vibe-coded-in-C browser do to mitigate this kind of exploit?
- roschdal 21d agoMy vibe-coded browser doesn't have a JIT JavaScript compiler. https://github.com/nordstjernen-web/northstar-browser/blob/main/docs/cve-2026-85046.md https://github.com/nordstjernen-web/northstar-browser/blob/m...
- Woodi 21d agostruct MessageBuffer { int msgType; union { char *name; int nameID; }; }; That finally convinced me getting data using functions (accessors, getters, setters) is a good thing, even in C :) Just all that unnecesary if's are so annoing and killing performance...
- jewsdienow 21d ago[dead]
- flippingheck 21d agoDoes that somehow also explain why many (most?) desktop users survive with just a browser? To be clear, I'm not saying it doesn't. I'm saying I don't understand.
- jewsdienow 21d ago[dead]
- gib444 21d agoThere's something funny about the site needing JavaScript to display anything
- jewsdienow 21d ago[dead]
- noduerme 21d agoJust outta curiosity because I can't find it at a cursory look - what exactly would be the type (coersion?) that would allow v8 to execute arbitrary code? Is this like something in post data to nodejs that terminates early and is able to run exec or something, like unto a sql injection?
- timschumi 21d agoThe Chromium issue is not public yet, so let's go with a very simple example. Let's say that you have a type confusion bug that (in terms of the interpreted language) allows you to use an Integer variable as an Array. That sounds nonsensical when just considering the high-level language, but your computer is going to need something to work with when running a script. For an Integer variable it will for example store the value, and for an Array it would store a pointer to a data area (and that area then contains values). Now, if the interpreter loses track of which type a certain variable is, then it will also not know whether to interpret the internal data as a plain value (arbitrarily chosen by the script/attacker) or a pointer to well-formed data (carefully chosen by the runtime). As an immediate step, letting the attacker use an address of their choosing for array operations would allow them to read and write arbitrary memory that is reachable with this form of addressing. I'm putting specific emphasis on "form of addressing" here, because the v8 authors have considered this possibility and put additional protections in place. Within the sandbox, "addresses" are limited to a size of 32 bits, and address within a dedicated 4 Gigabyte area that is specifically for interpreter data. Within that area you are not going to find a lot of critical data to affect outside operations, you'd have to find a way to escape that memory area first. The next part is going to be a bit hazy because it's been some time since I did Chromium exploitation, and getting code execution within the sandbox from data writes is itself not an easy task. Now, we have established that there is not a lot of terribly important data within the 4 GB area. The data managing the interpreter lives outside, and any JITed code will also live outside because it needs different access permissions. We only really get to play with Objects and their data. Objects handling executable code are rare, but there are a few that are at least adjacent. Last time I checked, WASM was one feasible choice where you get reasonably predictable results with custom data, as it included a pointer to actual executable code that represents the WASM program. Under the assumption that the WASM interpreter/compiler does its job correctly the full block of executable code will not be very interesting. However, any integer constant in the program will end up somewhere within the executable code, and that would give you enough controllable data to encode one or two arbitrary instructions and a relative jump to the next integer constant. To start execution at the first integer constant, we'd then just modify the Object data of the WASM program to slightly offset the entrypoint. And that's the short form of a possible (and likely outdated) way of getting semi-arbitrary code execution within the sandbox (as we are running as a WASM program, and therefore have all the usual syscall restrictions and other security features engaged).
- ruuda 21d ago> Type confusion in V8 Fortunately I disabled js by default. Unfortunately, it breaks about 30% of the web. Including nvd.nist.gov, which shows a completely blank page without js enabled, even though with js it’s just a simple page with only static content.
- internetter 21d ago> Unfortunately, it breaks about 30% of the web. Only 30?
- baobabKoodaa 21d agoPeople who disable JS are very likely to have delusions like this.
- ruuda 21d agoI think my subjective feeling is in that ballpark, yes. There are of course many sites that are more like web apps that require js, but those are relatively trusted, I added exceptions for them long ago. For sites that I visit for the first time, I think more than half still work to some extent. Maybe they are slightly broken, but at least I can read the page. I’d say around 20–30% of the web even gets _better_, because you don’t get ads or cookiewalls. But then there are also many sites that just remain a blank page, not even showing a message that js is required. (And as the sibling comment points out, recently Anubis is also becoming more common; maybe in recent months it’s closer to 40–50% unusable.) When I hit that, often I am reminded that I wasn’t that interested anyway, and I close the tab. So maybe it’s more than 30% that breaks, and a more accurate statement would be “of the sites where I ended up reading a page, I had to opt in to js about 30% of the time”.
- gib444 21d ago> Unfortunately, it breaks about 30% of the web Only 30%? In 2026? With CloudFlare and Anubis et al absolutely everywhere? Not to mention SPAs
- ruuda 21d ago
- theteapot 21d agoIs this known to be exploitable in any Electron apps, and specifically VSCode extensions?
- no-name-here 21d agoIs the HN title true that it affects all "all Chromium versions"? Per OP link, it only affects Chrome versions prior to .82; .82 was released as stable 2 days ago. [1] (HN title also does not match the original title, which is the CVE ID -- not particularly intuitive.) [1] https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html https://chromereleases.googleblog.com/2026/09/stable-channel...
- cubefox 21d ago"only"
- turpentine 20d agoUbuntu still considers 152.0.7977.64 stable.
- malinono 21d agoSandbox RCE again. Every "it's sandboxed so it's safe" pitch really means "we hope the sandbox holds." Not a security model, just a sentence.
- soiax 21d agoThe title is bad, it is not sandbox escape, it is "RCE inside the sandbox", so only RCE when sandbox is disabled.
- ajross 21d agoThis is missing the point. The whole point of a "sandbox" in the sense of defense in depth is precisely because it's expected that first-line security guarantees will be broken. Like, maybe V8 has a bug and you can write Javascript that fools it into running arbitrary binary code. But that's less dangerous, because the V8 engine runs in a process sandbox and doesn't have access to the rest of the browser state. Which is exactly what happened here, as it turns out. This isn't a breakout (or isn't alleged to be a breakout) to the broader OS, only to the sandbox environment.
- roschdal 21d agoCVE-2026-85046 and Northstar web browser: https://github.com/nordstjernen-web/northstar-browser/blob/main/docs/cve-2026-85046.md https://github.com/nordstjernen-web/northstar-browser/blob/m...
- iberator 21d agoGood antivirus should protect you from such attacks. Even zero day ones.
- neuroticnews25 21d agoI would guess it's now trivial for attackers to have an llm analyse every new commit to chromium repo linking to an issue that's 403 for security reasons, but maybe I'm missing something.
- notatoad 21d agoEqually trivial for Google to do the same thing. Is it trivial to do this in a way that exceeds googles own ability to detect flaws?
- neuroticnews25 21d agoWhat i meant is analyze fixes for already reported and fixed vulnerabilities before the updated version is pushed to users.
- throwaway27448 21d agoHell yea. Let's see some real leaks.
- nazmul_ai 21d ago[dead]
- claiir 21d agoAren’t all the big chrome vulnerabilities type confusion?
- jokoon 21d agoI prefer firefox, but doesn't firefox have a history of more similar exploits?
- dgellow 21d agoPretty sure every browser has that history
- odyssey7 21d agoIt’s really a shame that my engineering school requires me to use Google Chrome because their Honorlock browser extension[1] requires Google Chrome. You would think that an engineering school would be wiser than to require their students use a specific web browser that’s tied to a specific vendor. [1] https://app.honorlock.com/install/extension https://app.honorlock.com/install/extension
- turpentine 20d ago> You would think that an engineering school would be wiser... Schools are a business run by administrative staff who make purchasing decisions to solve business problems. Schools love to reduce billable teaching hours through online coursework, which invites academic dishonesty from students, and paying for honorlock is a way to achieve that reduction in expenditure, rather than paying tutors to supervise exams in person.
- cubefox 21d agoOtherwise known as a "zero-day exploit".
- mellowbadger70 21d ago[flagged]
- odyssey7 21d agoHow many Heartbleeds[1] must software users and our national security interests endure before the industry treats memory safety as a best practice for systems with exposure to the Internet? The V8 vulnerability being exploited today, CVE-2026-85046, is listed in NVD under CWE-843, "Access of Resource Using Incompatible Type ('Type Confusion')."[2] On this class of vulnerabilities, MITRE explains: > When a memory buffer is accessed using the wrong type, it could read or write memory out of the bounds of the buffer Memory safety is specifically intended to prevent errors like these from becoming arbitrary out-of-bounds memory access and native code execution. Even type safety --- from the 1970s --- can prevent type confusion. The CISA and the NSA have called for the adoption of memory-safe languages.[3] We exercise poor engineering judgment and poor ethics, as an industry, when we continue to expose users to classes of wholly avoidable security weaknesses in Internet-facing software. [1] https://en.wikipedia.org/wiki/Heartbleed https://en.wikipedia.org/wiki/Heartbleed [2] https://cwe.mitre.org/data/definitions/843.html https://cwe.mitre.org/data/definitions/843.html [3] https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4223298/nsa-and-cisa-release-csi-highlighting-importance-of-memory-safe-languages-in-so/ https://www.nsa.gov/Press-Room/Press-Releases-Statements/Pre...
- no-name-here 21d ago[dead]
- dchest 21d agoThere's more to it than just using a memory safe language.
- deleted 21d ago[deleted]
- dundarious 21d agoType confusion bugs exist in Rust programs too, the language does not eliminate all such issues (though it does help somewhat). I think it would be more prudent to wait until we have details before getting on the soapbox.
- 21d ago
- keel-control 21d agoGoogle has the means and ability to rewrite Chromium ; bug for bug in Rust from C++ using Astra & Fable. Same for the Linux kernel. Considering the Fermat's Last Theorem lean proof was 13MLoC and cost $300,000 it would cost $2M to rewrite Chromium & Linux in Rust going purely of combined LoC.
- mccr8 21d agoWriting Chromium entirely in Rust wouldn't prevent a JIT bug like this.
- keel-control 21d agook for this CVE exactly it wouldn't have worked but the general pareto 80-20 rule stands regarding the rest of the memory safety vulns
- weberer 21d agoWhy don't you do it and post it here then?
- keel-control 21d agoI don't have $2M
- rietta 21d agoAnother type confusion vulnerability! Interesting.
- tkot 21d ago> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) What's the difference between "executing arbitrary code inside the sandbox via a crafted HTML page" and running whatever is in the <script> tag?
- guipsp 21d agoIn the script tag you only have access to JS. This allows you to escape JS and have native code execution. It is still sandboxed by os-level primitives, but it is an escalation/first step in successful exploitation.
- tkot 20d agoI see, so there are certain things that arbitrary native code could try do (let's say, try to execute a certain syscall) that native code produced by the JIT compiler wouldn't normally be able to attempt?
- hnav 21d agoWhat do CVEs like this one mean for the likes of fly.io and cloudflare who use V8 for sandboxing 3p workloads? I guess they have some degree of KYC and some hardening outside the sandbox, but chaining this with a container escape running under a free tier account could pwn the host.
- Eridrus 21d agoYou can just ask ChatGPT these questions these days, but it was a fun read: fly.io depends on Firecracker microVMs, so you should be concerned if you're running untrusted code, but not concerned about other people interacting with you wrt v8. Cloudflare depends on v8 isolates, which depend on the trustworthiness of the v8 sandbox, which is a non-trivial hurdle, but not an insurmountable one for attackers with the resources to have a v8 bug in the first place.
- sans_souse 20d ago> just ask ChatGPT these questions these days, but it was a fun read I'd prefer they ask here. Just saying.
- shledery 21d ago[flagged]
- jimmydoe 21d agoI don't like this question, but why Google still open source Chrome as AI finding exploits so fast? I want Chrome stay open source, but why should I believe it's possible?
- vhiremath4 21d agoIt seems like the Chromium issue on their bugboard, which presumably would have the example HTML and vuln patch, is blocked from being viewed. Is this because making it public increases the risk of exploitation? https://issues.chromium.org/issues/542403045 https://issues.chromium.org/issues/542403045
- badabingfrlgl 21d agoNext time, sell it to me, I’ll pay $1001!