3 ms·
For what is this exploited in the wild when it doesn't include a sandbox escape? Is this chained with n-days?
by basilikum 1mo ago
For what is this exploited in the wild when it doesn't include a sandbox escape?
Is this chained with n-days?
- sebstefan 1mo agoIf it's in the CISA known exploited vulnerabilities catalog, tell me if I'm wrong but I assume people don't go around exploiting million dollar 0-days in public just to fuck around safely in a chrome sandbox. So maybe we're going to see another CVE for the sandbox escape soon?
- daveguy 1mo agoCrypto mining would be one application. But also, combined with a sandbox escape would make it particularly devastating. Usually full control of a device takes at least two exploits given the layers of security present in OS and browser environments.
- pizlonator 1mo agoThere's a risk that someone had been sitting on a sandbox escape that assumed having RCE inside the sandbox first, and so they'd been waiting for an RCE exactly like this one. Those folks would not be disclosing their sandbox escape unless they were good guys. (Posted with a memory safe WebKit, Fil-C FTW)
- pizdocalmin 1mo ago[flagged]
- oynqr 29d agoYou should add a disclaimer that you are the CEO of Fil-C. /s In the context of this vulnerability, I doubt memory safety would have made much of a difference. This is a great reminder though, currently doing a full userspace replacement on my 3D printer and Fil-C might be just what I need for the irreplaceable C parts.
- pizlonator 29d agoHow would memory safety have not made a difference?
- iTokio 28d agoType confusion, leads to using an object in memory with the wrong type, that means accessing memory with a different layout, like an out of bounds buffer. So I think memory safety does matter in that case.
- lima 29d agoIt would be chained with a separate 0day sandbox escape.