New graphics engine imperils users of Firefox and Chrome

Re:New graphics engine imperils users of Firefox and Chrome by extension on Wednesday May 11, 2011 @10:10AM (#2536487)

I'm not surprised. Video drivers are big, complicated and buggy. They are developed within very tight performance and time constraints and have had little reason to think about security until now. Exposing a large part of them to the public internet is begging for trouble.

On the other hand, if it's ever going to happen, it will probably take a few embarassing public incidents to make the vendors change their priorities.

[ Parent | on HN ]

Re:New graphics engine imperils users of Firefox and Chrome by imurray on Wednesday May 11, 2011 @10:35AM (#2536578)

Agreed (at least to the first part). The same argument has been made about the new web font technologies.

http://hackademix.net/2010/03/24/why-noscript-blocks-web-fon...

"It really worries me that the FreeType font library is now being made to accept untrusted content from the web. The library probably wasn’t written under the assumption that it would be fed much more than local fonts from trusted vendors who are already installing arbitrary executable on a computer, and it’s already had a handful of vulnerabilities found in it shortly after it first saw use in Firefox."

[ Parent | on HN ]

Re:New graphics engine imperils users of Firefox and Chrome by 0x0 on Wednesday May 11, 2011 @10:35AM (#2536579)

This should come as no surprise to anyone, really.

10 years ago we had similar issues with 2d graphics. For example, rendering huge fonts could cause the X display server to crash: http://xforce.iss.net/xforce/xfdb/9313

With WebGL, the attack surface is many times larger. I'm sure we'll see plenty of exploits leveraging vulnerabilities in the display subsystem.

[ Parent | on HN ]