alt Hacker NewsActively exploited sandbox RCE in all Chromium versions
Comments
Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.
I’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.
Brave is beating GrapheneOS on update timeliness:
https://github.com/GrapheneOS/Vanadium/releases
https://github.com/brave/brave-browser/releases
Only if you use Nightly wait maybe not.
Isn't this exactly why there is a sandbox? What can the RCE actually do or obtain within the sandbox?
Sounds wild.
(Posted from memory safe WebKit; i.e. WebKit compiled with filcc and all of WebKit's dependencies compiled with filcc.)
struct MessageBuffer
{
int msgType;
union {
char *name;
int nameID;
};That finally convinced me getting data using functions (accessors, getters, setters) is a good thing, even in C :) Just all that unnecesary if's are so annoing and killing performance...
Does anybody have a source for the "actively exploited" part of the HN title?
Not to downplay the severity (patch your browsers!), but there have been 5-10 actively-exploited V8 type confusion vulnerabilities in the last year. I'd be curious if this one blew up because it was the only one that was posted, or if it barely crossed some line in the collective consciousness this time around.
For what is this exploited in the wild when it doesn't include a sandbox escape?
Is this chained with n-days?
So basically, Edge, Brave and any other browser built on Chromium. Nice.
NIST probably had this one filed and ready to announce years ago
like those news agencies have obituaries of famous old people pre-written
Switch to Northstar web browser: https://github.com/nordstjernen-web/nordstjernen-browser
Why is this 8.8?
It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction.
Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.
$1k for this vuln is laughable. If the researcher wrote an exploit as the nday exploit devs did and sold it in the gray market they would of got significantly more.
As somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising.
"Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."
Doesn't everyone else immediately update everything on their computer before they start doing anything?
[flagged]
[dead]
[dead]
Just one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.
Let's take a moment to talk about the monetary value of this vulnerability.
According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this.
The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?
Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency?
It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.