5 ms·
> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (
by tkot 1mo ago
> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
What's the difference between "executing arbitrary code inside the sandbox via a crafted HTML page" and running whatever is in the <script> tag?
- guipsp 1mo agoIn the script tag you only have access to JS. This allows you to escape JS and have native code execution. It is still sandboxed by os-level primitives, but it is an escalation/first step in successful exploitation.
- tkot 29d agoI see, so there are certain things that arbitrary native code could try do (let's say, try to execute a certain syscall) that native code produced by the JIT compiler wouldn't normally be able to attempt?