News for hackers. Stuff that matters.

A comment on What a one line change did to the Chrome sandbox. Parent comment

Re:What a one line change did to the Chrome sandbox by ComodoHacker on Thursday April 23, 2020 @06:53AM (#22954594)
Has it been fixed in Firefox?
[ Parent | on HN ]
Re:What a one line change did to the Chrome sandbox by KMag on Thursday April 23, 2020 @07:36AM (#22954883)
The vulnerability is in Windows 10. Windows 10 has been fixed. It's not clear in the article what other mitigations are in place in Firefox to make exploitation more difficult.
[ Parent | on HN ]
Re:What a one line change did to the Chrome sandbox by tiraniddo on Thursday April 23, 2020 @08:11AM (#22955073)
Basically my PoC works exactly the same from Chrome GPU as FF Content Level 5 [1] there was no additional hardening. It was also easier to test as FF doesn't enable the Microsoft DLL signing mitigation should I could just do a direct CreateRemoteThread -> LoadLibrary without messing with KnownDlls.

[1] https://wiki.mozilla.org/Security/Sandbox

[ Parent | on HN ]