News for hackers. Stuff that matters.

A comment on Chrome 0-day exploit used in Operation WizardOpium. Parent comment

Re:Chrome 0-day exploit used in Operation WizardOpium by staticassertion on Saturday November 02, 2019 @02:57PM (#21429331)
I disagree. By having the browser implement these features we gain security. Chrome's sandbox is extremely powerful, and they can isolate and restrict all of those features you're describing very deliberately, in a way that a more generalized OS provided tool may not be able to.
[ Parent | on HN ]
Re:Chrome 0-day exploit used in Operation WizardOpium by jbk on Sunday November 03, 2019 @05:29AM (#21433121)
> I disagree. By having the browser implement these features we gain security.

This is the opposite: this FFT and convolution code is in C++, and therefore OUTSIDE of the JS sandbox.

My point is that there should be a minimum in C++ and MORE inside the JS sandbox.

[ Parent | on HN ]
Re:Chrome 0-day exploit used in Operation WizardOpium by staticassertion on Sunday November 03, 2019 @04:28PM (#21436744)
Browsers sandbox more than just the javascript VM/ renderer.
[ Parent | on HN ]
Re:Chrome 0-day exploit used in Operation WizardOpium by jbk on Sunday November 03, 2019 @06:02PM (#21437367)
Obviously not the webaudio part, seeing this exploit.
[ Parent | on HN ]
Re:Chrome 0-day exploit used in Operation WizardOpium by staticassertion on Sunday November 03, 2019 @07:59PM (#21438031)
There was likely a sandbox escape.
[ Parent | on HN ]