3 ms·
Among other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and
by arcfour 29d ago
Among other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and upload all of the files" or "spawn cmd.exe on the user's machine". How would you even do these things if you could run any JavaScript in the browser? You can't.
However, chrome.exe itself does because it's a native application, as is the sandboxed JavaScript interpreter inside of chrome.exe.
(This is a very oversimplified explanation but I think this is the disconnect people are having)
- bawolff 29d ago> JavaScript in the browser has no way to even express ... "list the contents of `C:\Users\Documents` and upload all of the files" this is besides the point, but javascript has the file system api. anyways to your broad point, i dont think this is convincing. What's the difference between not having an api vs having an api that is disabled (e.g. the syscall exists but is filtered). Either way you are not taking the action. RCE in the sandbox is an important step in the bigger exploit chain, but not because you can express things in the traditional syscalls inside the sandbox.
- zahlman 29d agoOkay, but we're still talking about running machine code inside the sandbox, where that functionality is still not available.
- arcfour 28d agoThe functionality is restricted, but the capability of expressing the intent at all exists.