News for hackers. Stuff that matters.

A comment on Chrome 0-day exploit used in Operation WizardOpium. Parent comment

Re:Chrome 0-day exploit used in Operation WizardOpium by jbk on Sunday November 03, 2019 @05:29AM (#21433121)
> I disagree. By having the browser implement these features we gain security.

This is the opposite: this FFT and convolution code is in C++, and therefore OUTSIDE of the JS sandbox.

My point is that there should be a minimum in C++ and MORE inside the JS sandbox.

[ Parent | on HN ]
Re:Chrome 0-day exploit used in Operation WizardOpium by staticassertion on Sunday November 03, 2019 @04:28PM (#21436744)
Browsers sandbox more than just the javascript VM/ renderer.
[ Parent | on HN ]
Re:Chrome 0-day exploit used in Operation WizardOpium by jbk on Sunday November 03, 2019 @06:02PM (#21437367)
Obviously not the webaudio part, seeing this exploit.
[ Parent | on HN ]
Re:Chrome 0-day exploit used in Operation WizardOpium by staticassertion on Sunday November 03, 2019 @07:59PM (#21438031)
There was likely a sandbox escape.
[ Parent | on HN ]