3 ms·
This "only" escapes the JavaScript sandbox. You still need to chain it with an escape for the process sandbox. So it's not just the boring stuff of turning a pr
by kllrnohj 29d ago
This "only" escapes the JavaScript sandbox. You still need to chain it with an escape for the process sandbox. So it's not just the boring stuff of turning a predictable crash into arbitrary execution, but also finding a second RCE vulnerability to chain this with
- fguerraz 29d agoIf it’s being exploited “in the wild”, it means someone has already found how to chain it, otherwise what would be the point?
- bethekidyouwant 29d agoRight but this actually hasn’t happened…
- r_lee 29d ago"Google is aware that an exploit for CVE-2026-85046 exists in the wild."
- kccqzy 29d agoRight and in recent memory Google actually awarded a renderer sandbox escape with $250k [0]. Now you can see actually how serious this is. [0]: https://news.ycombinator.com/item?id=44861106 https://news.ycombinator.com/item?id=44861106
- anonymars 29d agoI'm curious now, how is it being actively exploited? Unless there is already some other exploit with which it's currently being chained?
- r_lee 29d agothere are many vulns that are sitting idle waiting to be chained like this. plus in some cases adjacent bugs can be found once you find a bug like this.