News for hackers. Stuff that matters.

A comment on Hackers used zerodays to infect Windows, iOS, and Android users. Parent comment

Re:Hackers used zerodays to infect Windows, iOS, and Android... by caslon on Friday March 19, 2021 @03:32PM (#26517389)
> They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them."

Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer.

In this case, something like Firefox which shares much less attack surface would in fact solve the problem, because the problem is that other things have Chrome at the OS-level.

[ Parent | on HN ]
Re:Hackers used zerodays to infect Windows, iOS, and Android... by modeless on Friday March 19, 2021 @05:44PM (#26518427)
> Safari and Chrome share likely near 70%

This is wrong. I'd say it's more like 5%. Blink forked from WebKit 7 years ago and development has been very active on both sides since then. And probably the majority of the attack surface is outside Blink/WebKit proper to start with (e.g. JS engine, font libraries, media decoding, networking, etc).

[ Parent | on HN ]
Re:Hackers used zerodays to infect Windows, iOS, and Android... by saagarjha on Saturday March 20, 2021 @06:02AM (#26521937)
The JS engine is part of Blink and WebKit, but yes, they are essentially entirely different.
[ Parent | on HN ]
Re:Hackers used zerodays to infect Windows, iOS, and Android... by modeless on Saturday March 20, 2021 @12:33PM (#26524234)
I don't know about JSC, but V8 is very much a standalone project. I guess you could define it as just part of Blink but I don't think that's a very useful definition.
[ Parent | on HN ]
Re:Hackers used zerodays to infect Windows, iOS, and Android... by lozaning on Friday March 19, 2021 @04:41PM (#26517967)
>Windows and Android have Chrome built-in at the OS layer

How is Chrome built into Windows at the OS layer? Wouldn't that be IE or Edge?

[ Parent | on HN ]
Re:Hackers used zerodays to infect Windows, iOS, and Android... by kitsunesoba on Friday March 19, 2021 @04:52PM (#26518050)
Edge is now Chromium based and soon Edge-Chromium webviews will ship with the OS. The old IE/Edge webviews will remain for legacy but they'll eventually get stripped.
[ Parent | on HN ]
Re:Hackers used zerodays to infect Windows, iOS, and Android... by Alterlife on Friday March 19, 2021 @04:54PM (#26518068)
> Edge

I think that's OP's point. Edge uses chromium.

[ Parent | on HN ]