News for hackers. Stuff that matters.

A comment on Zenbleed. Parent comment

Re:Zenbleed by loeg on Monday July 24, 2023 @01:00PM (#36851051)
> Thankfully the exploit is highly dependent on a specific asm routine so exploiting it from JS or WASM in a browser should be extremely difficult. Otherwise a nefarious tab left open for hours in the background could exfiltrate without an issue.

At least one commentor here claims to be able to reproduce this with javascript: https://news.ycombinator.com/item?id=36849767 .

[ Parent | on HN ]
Re:Zenbleed by IshKebab on Monday July 24, 2023 @02:39PM (#36852478)
A very bold claim with zero evidence.
[ Parent | on HN ]
Re:Zenbleed by saagarjha on Monday July 24, 2023 @06:13PM (#36854959)
What about it is very bold? The instruction sequence mentioned seems pretty reasonable and not at all out of the question for a JavaScript JIT to generate.
[ Parent | on HN ]
Re:Zenbleed by felix-ht on Wednesday July 26, 2023 @10:24AM (#36878262)
It should be possible to patch this from the browser side as well.
[ Parent | on HN ]