Actively exploited sandbox RCE in all Chromium versions

(nvd.nist.gov)

86 points | by negura 1 hour ago

7 comments

  • david_shaw 19 minutes ago
    Let's take a moment to talk about the monetary value of this vulnerability.

    According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this.

    The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

    Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency?

    It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.

    • CookieCrisp 13 minutes ago
      While I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?
      • teravor 3 minutes ago
        ideally, an auction and the vendor or a government can bid against malicious actors (which can also be a government). hard to set up though.
    • computably 4 minutes ago
      > How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

      On average, probably not that much. What's the amortized cost of all testing, static analysis, and audit / code review, per "prevented potential bug"?

    • esseph 11 minutes ago
      The problem is they are being flooded with both fake AND real disclosures. Imagine if they tried to pay out $250,000 or more per bug? Would the cost be worth it? Maybe, but shareholders may not be pleased... Unless they viewed it as insurance against it being more financially sound for the finder to sell the exploit on the gray or black market instead...
  • thenewnewguy 13 minutes ago
    Does anybody have a source for the "actively exploited" part of the HN title?
  • Cider9986 1 hour ago
    Brave is beating GrapheneOS on update timeliness:

    https://github.com/GrapheneOS/Vanadium/releases

    https://github.com/brave/brave-browser/releases

    Only if you use Nightly wait maybe not.

    • d2kx 36 minutes ago
      This issue is already fixed in Google Chrome (152.0.7977.83)
      • azakai 2 minutes ago
        TFA says

        > Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

        So it was fixed in 152.0.7977.82 (before .83), if I read that right.

    • anon109 54 minutes ago
      Is graphene even affected? JIT is disabled in default configurations.
    • chuckadams 1 hour ago
      The release version just now updated to 152.0.7977.83 which has the fix.
      • fmajid 24 minutes ago
        I upgraded Vivaldi, which is reporting 152.0.7977.112
  • Terr_ 53 minutes ago
    As somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising.

    "Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."

  • petra303 1 hour ago
    Only a score of 8.8?
    • teravor 1 hour ago
      RCE inside sandbox, so requires chaining with another 0day.
      • zahlman 1 hour ago
        What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?
        • jimrandomh 18 minutes ago
          It means it can execute native code inside the sandbox, as opposed to Javascript. While still sandboxed, this lets it access some parts of the attack surface that JS would not have been able to, some of which may have other exploits that allow escaping the rest of the way.
        • jnwatson 1 hour ago
          It means it can execute arbitrary machine code in the sandbox.
        • johnsmith1840 21 minutes ago
          Memory isolation having one tab or account open on your bank and another on this page does not mean it could leak across the sandbox and steal bank account details but anything inside of your general page content can be lost
      • iririririr 39 minutes ago
        what is online ad networks for $100, alex
  • anonymousiam 23 minutes ago
    Just one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.
    • lima 17 minutes ago
      Which browser has a better security track record?
    • lta 15 minutes ago
      If we needed any more.
  • colincowardly 52 minutes ago
    [dead]