From object transition to RCE in the Chrome renderer

Re:From object transition to RCE in the Chrome renderer by soiax on Tuesday August 13, 2024 @04:47PM (#41239676)

No. There is a reason the author keeps repeating "arbitrary code execution in the Chrome renderer process." Because it's there, not in the browser process.

[ Parent | on HN ]

Re:From object transition to RCE in the Chrome renderer by armchairhacker on Tuesday August 13, 2024 @05:39PM (#41240134)

https://github.com/github/securitylab/tree/main/SecurityExpl...

> If successful, on Ubuntu 22.04, it should call launch xcalc when calc.html is opened in Chrome.

Then how does this work? It doesn't look like the provided build flags disable any sandbox that the distributed build doesn't.

[ Parent | on HN ]

Re:From object transition to RCE in the Chrome renderer by soiax on Wednesday August 14, 2024 @06:27AM (#41244544)

You can disable it runtime, with --no-sandbox command line option.

[ Parent | on HN ]