Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

you're taking someone's word it's being exploited. It says right at the top of the report

> allowed a remote attacker to execute arbitrary code *inside the sandbox*

A bug in V8 leads to code execution in Chrome's web page process. It does not lead to execution in general. For that you need other exploits that escape the web page process. Those are not detailed here. This CVE is not a big deal. You're responding the poster's title, not the actual CVE



> I chained this bug with an n-day sandbox escape and flagged the v8CTF.

https://serotav.github.io/Writeups/v8/when-sorting-leads-to-...


I believe that means the v8 sandbox, not a renderer sandbox, based on the v8CTF reference.


Then what it was chained to is the real issue, not this one. The entire point of having webpages run in their own process is to prevent bugs like this one from doing worse. If you're claiming this bug is the bug that matters, you're effectively claiming they shouldn't need to run pages in their own process and just trust that there are zero bugs. No major browser does that. Not Firefox, not Safari, and not Chromium.

that's why bugs in the webpage process pay out very little. Without a worse 2nd bug, they are less serious. Bugs that let you RCE outside the webpage process pay much higher.


Sophisticated attacks will always leverage multiple vulnerabilities. That’s why you have to think of any vulnerability holistically, not in isolation.


Then just call them both one exploit that allows arbitrary sandbox escape.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: