Actively exploited sandbox RCE in all Chromium versions
169 points by negura 3 hours ago | 81 comments

david_shaw 2 hours ago
Let's take a moment to talk about the monetary value of this vulnerability.

According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this.

The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency?

It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.

reply
arjie 38 seconds ago
Interesting question, and how much should a user pay Google to fix the vulnerability? I suppose the smallest unit of currency less than the amount of effort they'd have to put in to mitigate it. A fully market economy of bug fixing here is an interesting idea, certainly, but if I'm being honest I actually don't want to pay Google a thousand dollars to fix security issues. In the limit, what would happen is that I end up with the competitor browser Elgoog Emorhc which fixes security issues for free.
reply
strictnein 2 minutes ago
If this would have included a full RCE chain with Sandbox escape Google would have paid significantly more.

Having just a Sandbox RCE is neat, I've got some on my laptop currently, but it's just a piece of the puzzle.

reply
CookieCrisp 2 hours ago
While I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?
reply
quotemstr 56 minutes ago
You let the market decide. Google could purchase the bugs on the same market blackhats do.
reply
jsw97 45 minutes ago
In the past I would have thought this would incentivize finding bugs that might never be found. However it is now clear that all bugs that can be found will be found. So this makes a ton of sense.
reply
eru 36 minutes ago
> In the past I would have thought this would incentivize finding bugs that might never be found.

Isn't that a good thing?

> However it is now clear that all bugs that can be found will be found. So this makes a ton of sense.

If Google can find all the bugs nowadays, presumably with AI, why still pay a bug bounty? At least by this logic, bug bounties make less sense now.

reply
jsw97 32 minutes ago
Sure they make sense — you need some incentive to drive the price to zero.
reply
teravor 2 hours ago
ideally, an auction and the vendor or a government can bid against malicious actors (which can also be a government). hard to set up though.
reply
eru 37 minutes ago
What kind of auction would you like to run?

Remember that you can sell the same vulnerability to multiple people: it's software you can copy.

reply
Barbing 18 minutes ago
Maybe needs a Good-Guy-Buy-It-Now w/instant delivery at a fair price. (OK that’s kind of a threat—you’re running an auction and you have the price the corp has to pay to avoid the auction ending.)

$1k is so dumb and the fact we’re discussing auctions is proof (hello, Sundar, what you doing over there?).

Guess this will change after the next e.g. nationwide hospital ransomware by a hacker who publicly laments bounty rates, if the news cycle accommodates the story long enough.

reply
27183 49 minutes ago
it seems unlikely google's lawyers would go for this
reply
aeonik 38 minutes ago
Maybe some code is so important and heavily trafficked it becomes a public works project, and various legs can bid for pieces of the project, line how all infrastructure works.
reply
teravor 39 minutes ago
well that's why setting it up is hard, because you would want to do it in a way that what they want doesn't matter.
reply
paxys 8 minutes ago
There are plenty of people out there who find vulnerabilities and sell them to the highest bidder. Anyone is welcome to do it, including the people finding and reporting these exploits responsibly. There's no need to try and make a convoluted ethical justification. "I did this bad thing because you didn't pay me enough not to" doesn't work past the 6th grade.
reply
r_lee 23 minutes ago
this is why again, researchers should just honestly sell these to vuln brokers instead of donating them to trillion dollar companies for nothing.

nothing will change until big tech can no longer rip off security researchers

reply
Mtinie 12 minutes ago
> Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment.

Why not? Capitalism requires they maximize their value. These profitable companies lay bare at the altar, so they should understand the requirements of their god.

reply
computably 2 hours ago
> How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

On average, probably not that much. What's the amortized cost of all testing, static analysis, and audit / code review, per "prevented potential bug"?

reply
paulpauper 7 minutes ago
The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

in the darkweb, due to crypto, a lot. there is where the $ is, whether it's stealing crypto directly or phishing developers.

reply
esseph 2 hours ago
The problem is they are being flooded with both fake AND real disclosures. Imagine if they tried to pay out $250,000 or more per bug? Would the cost be worth it? Maybe, but shareholders may not be pleased... Unless they viewed it as insurance against it being more financially sound for the finder to sell the exploit on the gray or black market instead...
reply
Barbing 31 minutes ago
Pre-flood, they didn’t pay more did they?

> viewed it as insurance

Of course. Beyond the ethics, the social obligation, sleeping well at night by compensating hardworking people fairly.

“We can’t pay more or we’d have to hire more human reviewers” should never be a massive company’s line of thinking.

reply
rglover 40 minutes ago
They should just multiply a base rate against the severity level. Say the base rate is ranged so low-severity stuff is $500-1K base but high-severity stuff is $10K base. That would net a researcher ~$88K for this specific bug (8.8 severity).
reply
r_lee 22 minutes ago
it's such a drop in the bucket, it wouldn't make any difference
reply
publlus_enigma 39 minutes ago
Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.
reply
eru 35 minutes ago
In the future we can ask that your JaveScript and Wasm comes with a proof of being benign.
reply
asveikau 23 minutes ago
I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking.
reply
whizzter 4 minutes ago
I still do "random" browsing in FF with NoScript, that said, I'll acknowledge the frequency of updates of Chrome,etc and years of hardening.

It's not the Bonzi-buddy and driveby-installed IE toolbars wild west of the early 00s.

reply
Espressosaurus 8 minutes ago
It became insane because nothing bloody worked without Javascript some time in the early 2010s.

Like cellphones, javascript became necessary if you want to use webmail, access your bank's website, or whatever.

reply
throwatdem12311 14 minutes ago
I’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.
reply
jesse_dot_id 4 minutes ago
There's been a Chrome CVE like every week ever since it came out.
reply
Cider9986 3 hours ago
Brave is beating GrapheneOS on update timeliness:

https://github.com/GrapheneOS/Vanadium/releases

https://github.com/brave/brave-browser/releases

Only if you use Nightly wait maybe not.

reply
d2kx 2 hours ago
This issue is already fixed in Google Chrome (152.0.7977.83)
reply
azakai 2 hours ago
TFA says

> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

So it was fixed in 152.0.7977.82 (before .83), if I read that right.

reply
anon109 2 hours ago
Is graphene even affected? JIT is disabled in default configurations.
reply
chuckadams 3 hours ago
The release version just now updated to 152.0.7977.83 which has the fix.
reply
fmajid 2 hours ago
I upgraded Vivaldi, which is reporting 152.0.7977.112
reply
thenewnewguy 2 hours ago
Does anybody have a source for the "actively exploited" part of the HN title?
reply
john_strinlai 2 hours ago
by nature of being in the "known exploited vulnerabilities catalog" (https://www.cisa.gov/known-exploited-vulnerabilities-catalog...)

"CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild."

reply
crtasm 2 hours ago
This line, I think? >This CVE is in CISA's Known Exploited Vulnerabilities Catalog
reply
esseph 2 hours ago
"Google has confirmed that an exploit exists in the wild but has not disclosed information about the threat actors, targeted organizations, or attack campaigns while the update is still rolling out."
reply
basilikum 16 minutes ago
For what is this exploited in the wild when it doesn't include a sandbox escape?

Is this chained with n-days?

reply
TZubiri 12 minutes ago
Why is this 8.8?

It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction.

Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.

reply
petra303 3 hours ago
Only a score of 8.8?
reply
teravor 3 hours ago
RCE inside sandbox, so requires chaining with another 0day.
reply
TZubiri 7 minutes ago
This doesn't affect the score though, the reason there's 1.2 points less than the max is because there is a Required User Interaction. The user needs to visit a specific html page.

Even with the sandbox protection layer, the rest of the parameters are maxed out.

reply
zahlman 3 hours ago
What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?
reply
StilesCrisis 55 minutes ago
Chrome runs webpages in individual sandbox processes with very low privileges, as a defense-in-depth strategy. It generally requires at least two exploits to actually affect a user--first, get RCE in a sandboxed process, then find a separate vulnerability that lets you escape the sandbox process entirely. For this bug to have actually been used in the wild, there was almost certainly a second bug as well.
reply
jimrandomh 2 hours ago
It means it can execute native code inside the sandbox, as opposed to Javascript. While still sandboxed, this lets it access some parts of the attack surface that JS would not have been able to, some of which may have other exploits that allow escaping the rest of the way.
reply
jnwatson 3 hours ago
It means it can execute arbitrary machine code in the sandbox.
reply
r_lee 2 hours ago
I think people would like to understand what the "sandbox" is here and what isolation does it provide, is it an unprivileged process? something chromium specific? a v8/JS thing? etc.
reply
ranger_danger 2 hours ago
reply
Genwald 2 hours ago
V8 also has its own sandbox, which I believe exists in that sandbox. I assume that's the one this exploit has RCE in, but its unclear.

https://chromium.googlesource.com/v8/v8.git/+/refs/heads/mai...

reply
insanitybit 2 hours ago
I would assume in this case that there's full renderer control, not just a bypass of the in-process isolation.
reply
r_lee 2 hours ago
great link, thanks
reply
zahlman 2 hours ago
Okay, and why is that more of a security risk than executing arbitrary JavaScript in the sandbox?
reply
arcfour 24 minutes ago
Among other things, JavaScript in the browser has no way to even express "kill PID 1234 on the user's machine" or "list the contents of `C:\Users\Documents` and upload all of the files" or "spawn cmd.exe on the user's machine". How would you even do these things if you could run any JavaScript in the browser? You can't.

However, chrome.exe itself does because it's a native application, as is the sandboxed JavaScript interpreter inside of chrome.exe.

(This is a very oversimplified explanation but I think this is the disconnect people are having)

reply
insanitybit 60 minutes ago
Because Javascript theoretically can't just access files on disk. Control over the render would let you do that, if not for the process level sandbox, which constraints things like file access, system, calls, etc.

But the process is still more capable than the VM. The process can talk to other processes via IPC, for example.

That's why you don't go from "javascript -> computer is taken over", instead you go from "javascript -> renderer control -> computer is taken over".

reply
r_lee 2 hours ago
because with proper code exec you can trigger other bugs to escalate beyond the sandbox, whereas with JS you'd have to find a bug to escape from JS to native

can't get a proper ios/Android RCE with just JS code exec

reply
p-e-w 2 hours ago
It can do some things that JS can’t do, such as invalid pointer writes. But you are correct that this doesn’t automatically imply system access.
reply
TacticalCoder 52 minutes ago
> It means it can execute arbitrary machine code in the sandbox.

Well which is precisely why we have sandboxes.

To me "executing arbitrary code in the sandbox" is similar to "I don't give a flying fuck for it's what a sandbox is for".

More information is needed. As someone commented: this has to be paired with at least another exploit to make anything remotely useful.

A sandbox is a sandbox. We want to understand how "code running in a sandbox" is "actively exploited".

reply
johnsmith1840 2 hours ago
Memory isolation having one tab or account open on your bank and another on this page does not mean it could leak across the sandbox and steal bank account details but anything inside of your general page content can be lost
reply
iririririr 2 hours ago
what is online ad networks for $100, alex
reply
Terr_ 2 hours ago
As somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising.

"Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."

reply
TZubiri 6 minutes ago
This seems irrelevant as the issue talks about being exploitable with a crafted HTML page, no mention of JS. If true, you would be able to be hit without js enabled.
reply
colincowardly 2 hours ago
[dead]
reply
anonymousiam 2 hours ago
Just one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.
reply
fidotron 56 minutes ago
Chrome product management is horrible. Chrome software engineering is some of the best ever done.

(And no, I don't use it except for testing).

reply
noir_lord 51 minutes ago
I don’t disagree, two or more things can be true at once.

That said I still use Firefox for other reasons.

I simply don’t trust google, I don’t trust Mozilla either but I do trust them more than Google and you do kinda have to have a browser to function in the modern world.

reply
Barbing 26 minutes ago
Of all the reasons to use non-Chromium browsers whenever possible(!), this isn’t really on the list.
reply
lima 2 hours ago
Which browser has a better security track record?
reply
Cider9986 2 hours ago
Vanadium makes improvements on Chromium. https://grapheneos.org/features#vanadium
reply
StilesCrisis 49 minutes ago
Most of those are just changing flags, not really unique development. Like "disable JIT" is a Chromium flag. "Zero-init everything" is a Clang flag.
reply
esseph 2 hours ago
Right, but it's value-add on a derivative, not its own standalone engine.
reply
p-e-w 2 hours ago
Firefox with uBlock Origin. It’s astonishing how many exploits uBO stops before they ever reach your browser engine. It’s the antivirus of the 2020s.
reply
Cider9986 37 minutes ago
Brave would be a much better option if you want security and good adblocking.
reply
Alifatisk 2 hours ago
I suggest Zen browser (fork of FF), it feels closer to chrome.
reply
Barbing 23 minutes ago
I hear about Zen. Random q:

It can’t trick Canva into letting you use the color picker, or otherwise enable it, can it - if someone happens to know?

(What a dumb feature to be locked to the Googlesphere.)

reply
aleksandrm 21 minutes ago
What does it mean "closer to chrome"?
reply
ZiiS 58 minutes ago
In a good way?
reply
paulpauper 4 minutes ago
chrome has more bugs, not necessarily because it's less secure, but its popularity makes it a bigger target, so more bugs are found
reply
StilesCrisis 52 minutes ago
Oh, right, because other browsers never have bugs.
reply
lta 2 hours ago
If we needed any more.
reply