Actively exploited sandbox RCE in all Chromium versions

petra303

Only a score of 8.8?

Cider9986

Brave is beating GrapheneOS on update timeliness: https://github.com/GrapheneOS/Vanadium/releases https://github.com/brave/brave-browser/releases Only if you use Nightly wait maybe not.

Terr_

As somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising. "Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."

anonymousiam

Just one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.

david_shaw

Let's take a moment to talk about the monetary value of this vulnerability. According to the Chrome release page ( https://chromereleases.googleblog.com/2026/09/stable-channel... ), Google paid a researcher $1000 for ethically reporting this. The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild? Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency? It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.

thenewnewguy

Does anybody have a source for the "actively exploited" part of the HN title?

publlus_enigma

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

basilikum

For what is this exploited in the wild when it doesn't include a sandbox escape? Is this chained with n-days?

throwatdem12311

I’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.

TZubiri

Why is this 8.8? It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction. Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.

snorbleck

So basically, Edge, Brave and any other browser built on Chromium. Nice.

johnnyApplePRNG

NIST probably had this one filed and ready to announce years ago like those news agencies have obituaries of famous old people pre-written

radium3d

Doesn't everyone else immediately update everything on their computer before they start doing anything?

pizlonator

Sounds wild. (Posted from memory safe WebKit; i.e. WebKit compiled with filcc and all of WebKit's dependencies compiled with filcc.)

Animats

Chromium, or just Chrome?

pertique

Not to downplay the severity (patch your browsers!), but there have been 5-10 actively-exploited V8 type confusion vulnerabilities in the last year. I'd be curious if this one blew up because it was the only one that was posted, or if it barely crossed some line in the collective consciousness this time around.

mikeweiss

Isn't this exactly why there is a sandbox? What can the RCE actually do or obtain within the sandbox?

b8

$1k for this vuln is laughable. If the researcher wrote an exploit as the nday exploit devs did and sold it in the gray market they would of got significantly more.

Woodi

struct MessageBuffer { int msgType; union { char *name; int nameID; }; }; That finally convinced me getting data using functions (accessors, getters, setters) is a good thing, even in C :) Just all that unnecesary if's are so annoing and killing performance...

gib444

There's something funny about the site needing JavaScript to display anything