Chrome 0-day exploit used in Operation WizardOpium

Re:Chrome 0-day exploit used in Operation WizardOpium by CoolGuySteve on Saturday November 02, 2019 @09:46AM (#21427670)

MacOS’s media framework uses sandboxes so even if media gets exploited it wouldn’t be able to write to disk or launch processes like in this example.

There’s really no excuses in this case for WebAudio, of all things, to be able to write to disk. And it’s dubious that Chrome should be able to launch any processes outside of the few specific child jobs it needs for process isolation.

[ Parent | on HN ]

Re:Chrome 0-day exploit used in Operation WizardOpium by Avamander on Saturday November 02, 2019 @11:25AM (#21428191)

We need something like `pledge` from BSD available across all platforms. Would mitigate quite a few of these exploits. Though, shipping good SELinux policy could solve the problem as well, maybe even better.

[ Parent | on HN ]