News for hackers. Stuff that matters.
Re:An iframe from googlesyndication.com tries to access the ... by tehlike on Sunday December 19, 2021 @01:52PM (#29616999)
"In a lab environment" -> Certainly happens, but what if the script targets "specific devices" like "samsung galaxy s10" which google won't be able list exhaustively?

What if bad actors figured out a way to identify google's emulators and avoid doing bad stuff in that situation?

The part i said "google develops browser solutions to prevent issues like this" is exactly what features policy will end up doing. But google's ad systems and chrome features don't always move at the same speed, but you can be sure that whatever ad malware team is finding will help chrome team to strengthen their defense.

Re:An iframe from googlesyndication.com tries to access the ... by d0gbread on Sunday December 19, 2021 @02:09PM (#29617190)
I thought they meant more like sandbox environment. Why would the API to access those things exist at all?
Re:An iframe from googlesyndication.com tries to access the ... by jimbojet on Sunday December 19, 2021 @02:17PM (#29617285)
The API exists because zoom.com request microphone and camera through an iframe is a legit use case. As OP said below CSPs exist so that enterprises can lock down those vulnerabilities. But wouldn’t make sense to lock it down for all consumers.
Re:An iframe from googlesyndication.com tries to access the ... by tehlike on Sunday December 19, 2021 @02:11PM (#29617221)
Sandbox is provided through things like ContentSecurityPolicy and Feature Policies. See my comment on this.