5 ms·

Plain Chrome in Linux faired similarly didn't it?

• mtgx 14y ago
  So the other Chrome hacks were managed through Windows/Mac OS exploits?
  • drivebyacct2 14y ago
    Maybe it was just attacked on Windows, the only reference I can find is not super technical and references "zero-days" in the browser itself.
    • eaxbin 14y ago
      The sources I've seen all refer to a Windows stack-overflow / exploit.
      • justinschuh 14y ago
        There was a type confusion in WebKit that got code execution inside the sandbox, and then a Windows kernel vulnerability to break out.
• ukdm 14y ago
  "Chrome was compromised using similar methods to the IE10 and Firefox attacks. MWR Labs bypassed Chrome’s sandbox and used a Windows kernel vulnerability in Windows 7 to elevate privileges as well as execute commands outside of the sandbox. In addition to executing code, MWR researchers were able to read memory and find the base addresses of certain .DLL files." http://www.geek.com/articles/geek-pick/internet-explorer-10-chrome-and-firefox-hacked-at-pwn2own-2013037/ http://www.geek.com/articles/geek-pick/internet-explorer-10-...
  • hollerith 14y ago
    Since that page does not mention Linux, I cannot imagine what relevance it has to grandparent.
    • ukdm 14y ago
      Yeah, my mistake, I meant it to be in response to mtgx
  • justinschuh 14y ago
    As one of the owners of the Chrome Windows sandbox, that level of inaccuracy hurts to read. The correct statement is that Nils and Jon's pwn2own exploit bypassed the sandbox by using a Windows kernel vulnerability that's exposed in every process on the system. You can argue about the extent to which you should be able to rely on the kernel to enforce its guarantees, but the component that failed isn't a point of debate.