Serious Chrome zero-day

Re:Serious Chrome zero-day by nneonneo on Thursday March 07, 2019 @02:17AM (#19326156)

So what happened here? There's an in-the-wild exploit that's bypassing sandboxing - so there must be at least two bugs, or the sandbox isn't tight enough (which, for Chrome, would surprise the hell out of me).

[ Parent | on HN ]

Re:Serious Chrome zero-day by intherdfield on Thursday March 07, 2019 @08:27PM (#19334364)

"The second vulnerability was in Microsoft Windows. It is a local privilege escalation in the Windows win32k.sys kernel driver that can be used as a security sandbox escape."

https://security.googleblog.com/2019/03/disclosing-vulnerabi...

[ Parent | on HN ]

Re:Serious Chrome zero-day by aboodman on Thursday March 07, 2019 @02:26PM (#19331279)

I used to work on Chrome. There have been periodic sandbox escapes, and chained exploits that escape to userland are routinely performed at pwn2own. This is just notable because there is a live exploit in the wild.

[ Parent | on HN ]

Re:Serious Chrome zero-day by GordonAitchJay on Friday March 08, 2019 @11:19PM (#19344433)

There there any public information about what the live exploit does?

[ Parent | on HN ]