News for hackers. Stuff that matters.

A comment on Israeli firm's digital ads enabling installation of 'zero-click' spyware. Parent comment

Re:Israeli firm's digital ads enabling installation of 'zero... by hn_throwaway_99 on Thursday October 15, 2026 @04:37PM (#50109852)
OK, I read the report, but I'm still not clear on what the browser vulnerability is. This clearly seems like something browser vendors should be able to patch, correct?

The article does say "Both samples use a COM hijack for persistence, though make use of different DLLs." So does this only affect Windows machines? I didn't have time to read the linked 2021 report on Candiru, so maybe more details are there, but for such a detailed write up it would be helpful if the article was more explicit about which browser vulnerability was exploited.

[ Parent | on HN ]
Re:Israeli firm's digital ads enabling installation of 'zero... by halJordan on Thursday October 15, 2026 @06:22PM (#50111232)
The os exploit is, within this context, after the fact and therefore a non sequitur. You should look up the Project Zero watering hole analysis where they revealed something like 17 0-days being delivered to visitors of one particular site. It's likely that citizen labs only had windows exemplars.
[ Parent | on HN ]
Re:Israeli firm's digital ads enabling installation of 'zero... by driverdan on Thursday October 15, 2026 @09:28PM (#50112614)
Do you have a link? Why would a site burn 17 0-days like that?
[ Parent | on HN ]
Re:Israeli firm's digital ads enabling installation of 'zero... by un-nf on Thursday October 15, 2026 @05:42PM (#50110741)
It was a Windows exploit that ran. An adBlocker (funnily enough) would've been an excellent defense against this, given that the exploit ran in JavaScript served in targeted ads.

Though, there is a browser patch for this, don't advertise so much identifiable information that an advertiser can identify a user or their employer. That's the defense, but it'll never happen.

[ Parent | on HN ]