Back

Actively exploited sandbox RCE in all Chromium versions

189 points4 hoursnvd.nist.gov
david_shaw2 hours ago

Let's take a moment to talk about the monetary value of this vulnerability.

According to the Chrome release page (https://chromereleases.googleblog.com/2026/09/stable-channel...), Google paid a researcher $1000 for ethically reporting this.

The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment. But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth. Why should a researcher be effectively penalized for responsibly telling a vendor instead of selling the bug to a "research firm" or three-letter agency?

It's one thing if you're an open source project maintainer just trying to put something out to the community. The math is a lot different if you're Google.

tptacek1 hour ago

If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of the vulnerability; payments on black market are tranched (explicitly or less explicitly, as with "maintenance payments") based on whether they're patched.

Further: a vulnerability is probably not worth that much either, even if it's a hypercapable vulnerability, because the grey market buys full enablement kits, not vulnerability information. People making 6 figures on vulnerabilities are selling fully enabled full chain exploit systems, not just intelligence about a sandbox escape.

CookieCrisp2 hours ago

While I agree 1000 is hilariously low for this, worth is hard to quantify. Do you pay what it could theoretically cost your company? the amount the top bidding bad actor would be willing to pay?

quotemstr2 hours ago

You let the market decide. Google could purchase the bugs on the same market blackhats do.

ajkjk43 minutes ago

we really do not want to engineer a system in which using bugs to make money is considered economically legitimate activity. It is still crime. The main reason to report bugs and get the bounties for doing so is still because it makes the world safer and healthier. The money is there to make is to incentivize the work of finding and reporting them -- not to outbid the bad actors.

bawolff54 minutes ago

Well, someone did decide to tell google about this in exchange for a thousand dollars (albeit unclear how much the money was the motivator). Doesn't that mean the market did decide in google's favour?

tptacek59 minutes ago

Google directly competes with the grey market for vulnerabilities. They are competitive in a bunch of different directions:

* They pay for vulnerabilities without reliable exploits (more for vulnerabilities that are demonstrably reliable).

* They don't require you to actually build a reliable exploit chain.

* They pay up front, not in tranches.

* They work with essentially all comers, unlike the grey market, where you're generally subcontracting to sell your first few.

asdfaoeu56 minutes ago

Blackhat markets will always be able to pay better. Selling to Google though you aren't chancing jail time.

+1
quotemstr46 minutes ago
jsw972 hours ago

In the past I would have thought this would incentivize finding bugs that might never be found. However it is now clear that all bugs that can be found will be found. So this makes a ton of sense.

+1
eru2 hours ago
teravor2 hours ago

ideally, an auction and the vendor or a government can bid against malicious actors (which can also be a government). hard to set up though.

eru2 hours ago

What kind of auction would you like to run?

Remember that you can sell the same vulnerability to multiple people: it's software you can copy.

Barbing1 hour ago

Maybe needs a Good-Guy-Buy-It-Now w/instant delivery at a fair price. (OK that’s kind of a threat—you’re running an auction and you have the price the corp has to pay to avoid the auction ending.)

$1k is so dumb and the fact we’re discussing auctions is proof (hello, Sundar, what you doing over there?).

Guess this will change after the next e.g. nationwide hospital ransomware by a hacker who publicly laments bounty rates, if the news cycle accommodates the story long enough.

271832 hours ago

it seems unlikely google's lawyers would go for this

aeonik2 hours ago

Maybe some code is so important and heavily trafficked it becomes a public works project, and various legs can bid for pieces of the project, line how all infrastructure works.

teravor2 hours ago

well that's why setting it up is hard, because you would want to do it in a way that what they want doesn't matter.

spacedoutman55 minutes ago

"because researchers shouldn't hold bugs for ransom or demand high payment" Maybe they should now, not like anyone else cares about ethics anyway.

paxys1 hour ago

There are plenty of people out there who find vulnerabilities and sell them to the highest bidder. Anyone is welcome to do it, including the researchers and hackers reporting them responsibly. There's no need to try and make a convoluted ethical justification. "I did this bad thing because you didn't pay me enough not to" doesn't work past the 6th grade.

dataflow58 minutes ago

It sounds insultingly low, yeah. I'm trying to imagine why they would pay so little. The only two reasons I can think of are either (a) they were already aware of it and fixing it, and therefore the report didn't really change much, or (b) it requires an unusual configuration or otherwise rare opportunity to that makes it impractical to exploit most users. Really curious to see what the issue was whenever it gets made public.

solenoid093750 minutes ago

(c) there are so many undiscovered vulnerabilities that it doesn't make sense for them to offer a decent payout

bawolff57 minutes ago

> But at the same time, if someone submits a critical issue like this, it makes sense to pay them what the bug's actually worth.

I'd point out that part of the reason the grey and black market pays so well is because it is that type of market. You have to pay people extra to look past their morals and a risk premium against potential reputational and legal consequences.

That said, the gap is probably not just that.

s1artibartfast51 minutes ago

It seems like by definition it is.

Someone could sell it on the black market, sell it to Google, or just move on with their life and not sell it.

I don't know what this is worth on the black market, maybe I'd be scammed by even trying to sell it. Maybe I don't want to be a bad person. These are all things that go into the prices

arjie1 hour ago

Interesting question, and how much should a user pay Google to fix the vulnerability? I suppose the smallest unit of currency less than the amount of effort they'd have to put in to mitigate it. A fully market economy of bug fixing here is an interesting idea, certainly, but if I'm being honest I actually don't want to pay Google a thousand dollars to fix security issues. In the limit, what would happen is that I end up with the competitor browser Elgoog Emorhc which fixes security issues for free, and pays very little for them, which is the status quo.

In the world where security issues are paid for entirely at market rate, it would also be very important to not use browsers by poor groups because they would be unable to pay for security reports on the market and consequently the browsers would be less secure.

Interesting idea, for sure, but I don't think it lands in a place I want to go since I neither desire stochastic payments nor desire that all browsers should be from large corporations.

strictnein1 hour ago

If this would have included a full RCE chain with Sandbox escape Google would have paid significantly more.

Having just a Sandbox RCE is neat, I've got some on my laptop currently, but it's just a piece of the puzzle.

computably2 hours ago

> How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

On average, probably not that much. What's the amortized cost of all testing, static analysis, and audit / code review, per "prevented potential bug"?

r_lee1 hour ago

this is why again, researchers should just honestly sell these to vuln brokers instead of donating them to trillion dollar companies for nothing.

nothing will change until big tech can no longer rip off security researchers

Mtinie1 hour ago

> Ethical disclosure is a complicated topic, because researchers shouldn't hold bugs for ransom or demand high payment.

Why not? Capitalism requires they maximize their value. These profitable companies lay bare at the altar, so they should understand the requirements of their god.

wilg1 hour ago

Seems like it was worth $1000 to the researcher in question.

esseph2 hours ago

The problem is they are being flooded with both fake AND real disclosures. Imagine if they tried to pay out $250,000 or more per bug? Would the cost be worth it? Maybe, but shareholders may not be pleased... Unless they viewed it as insurance against it being more financially sound for the finder to sell the exploit on the gray or black market instead...

Barbing2 hours ago

Pre-flood, they didn’t pay more did they?

> viewed it as insurance

Of course. Beyond the ethics, the social obligation, sleeping well at night by compensating hardworking people fairly.

“We can’t pay more or we’d have to hire more human reviewers” should never be a massive company’s line of thinking.

rglover2 hours ago

They should just multiply a base rate against the severity level. Say the base rate is ranged so low-severity stuff is $500-1K base but high-severity stuff is $10K base. That would net a researcher ~$88K for this specific bug (8.8 severity).

vlovich12341 minutes ago

CVE severity is a terrible way to do this. If you follow the cybersecurity space you should know why.

r_lee1 hour ago

it's such a drop in the bucket, it wouldn't make any difference

paulpauper1 hour ago

The CVE associated with it (CVE-2026-85046) is already being exploited in the wild. If we put our thinking caps on, how much do you think this vulnerability is actually worth? How much do you think an organization like Google would spend on, for example, AI tokens or compute to detect this internally before it was found and exploited in the wild?

in the darkweb, due to crypto, a lot. there is where the $ is, whether it's stealing crypto directly or phishing developers.

publlus_enigma2 hours ago

Normalising running arbitrary code delivered over the internet (in the form of JavaScript and WASM), as a necessary condition for accessing most web pages may not have been one of the best decisions we have made.

tcdent54 minutes ago

V8 as a runtime goes far deeper than just webpages.

eru2 hours ago

In the future we can ask that your JaveScript and Wasm comes with a proof of being benign.

valleyer59 minutes ago
asveikau1 hour ago

I remember noticing this shift in nerd culture. In the early 2000s, it was common for people to say on places like Slashdot that they don't trust JavaScript and run their browser with it off. In the early 2010s, I noticed HN commenters thought this was insane, tinfoil hat type thinking.

bawolff51 minutes ago

In fairness, in the early 2000s they were probably right. Early browser security model was a bit of a mess. The fact that this article is even talked about is a sign of how much better things are.

whizzter1 hour ago

I still do "random" browsing in FF with NoScript, that said, I'll acknowledge the frequency of updates of Chrome,etc and years of hardening.

It's not the Bonzi-buddy and driveby-installed IE toolbars wild west of the early 00s.

Espressosaurus1 hour ago

It became insane because nothing bloody worked without Javascript some time in the early 2010s.

Like cellphones, javascript became necessary if you want to use webmail, access your bank's website, or whatever.

ThunderSizzle49 minutes ago

I still run with u matrix though, and most third party requests can be limited, but I no longer have enough patience when a required page doesn't work - I'll just rely on ublock origin to work.

nixosbestos52 minutes ago

I say this as someone does NOT disable JS in my main browser (because like, I have a job), but also knows a fair bit about why Firefox inside Tails now restarts in some cases...

It's the classic thing. Across every gdmf metric, excluding with "true empathy", no one *gives a fuck* until it affects them, or someone within (1-3) degrees of separatation. And having broad empathy is generally a good way to get yourself labeled/astrocized: both about as obvious "compriate" and obvious "adversary".

throwatdem123111 hour ago

I’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.

jesse_dot_id1 hour ago

There's been a Chrome CVE like every week ever since it came out.

Cider99863 hours ago

Brave is beating GrapheneOS on update timeliness:

https://github.com/GrapheneOS/Vanadium/releases

https://github.com/brave/brave-browser/releases

Only if you use Nightly wait maybe not.

d2kx3 hours ago

This issue is already fixed in Google Chrome (152.0.7977.83)

azakai2 hours ago

TFA says

> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

So it was fixed in 152.0.7977.82 (before .83), if I read that right.

anon1093 hours ago

Is graphene even affected? JIT is disabled in default configurations.

chuckadams3 hours ago

The release version just now updated to 152.0.7977.83 which has the fix.

fmajid3 hours ago

I upgraded Vivaldi, which is reporting 152.0.7977.112

johnnyApplePRNG57 minutes ago

NIST probably had this one filed and ready to announce years ago

like those news agencies have obituaries of famous old people pre-written

thenewnewguy2 hours ago

Does anybody have a source for the "actively exploited" part of the HN title?

john_strinlai2 hours ago

by nature of being in the "known exploited vulnerabilities catalog" (https://www.cisa.gov/known-exploited-vulnerabilities-catalog...)

"CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild."

crtasm2 hours ago

This line, I think? >This CVE is in CISA's Known Exploited Vulnerabilities Catalog

esseph2 hours ago

"Google has confirmed that an exploit exists in the wild but has not disclosed information about the threat actors, targeted organizations, or attack campaigns while the update is still rolling out."

basilikum1 hour ago

For what is this exploited in the wild when it doesn't include a sandbox escape?

Is this chained with n-days?

snorbleck1 hour ago

So basically, Edge, Brave and any other browser built on Chromium. Nice.

TZubiri1 hour ago

Why is this 8.8?

It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction.

Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.

Terr_3 hours ago

As somebody who prefers to browse with JS off whenever possible, there's something absurd about the balance everyone takes for granted between (A) your personal safety against a devastating hack by malicious code and (B) surveillance advertising.

"Sorry, but to enter this shop you need to take one of the used syringes from that pile some dude delivers every day and poke yourself with it."

TZubiri1 hour ago

This seems irrelevant as the issue talks about being exploitable with a crafted HTML page, no mention of JS. If true, you would be able to be hit without js enabled.

krackers1 hour ago

It mentions a type confusion in V8. Is it possible to trigger that without JS enabled?

The "all chromium versions" part of the title is also misleading, most browser CVEs do not distinguish between "untested lower bound" vs "affects all" (even though it seems like it'd be trivial to bisect).

petra3034 hours ago

Only a score of 8.8?

teravor3 hours ago

RCE inside sandbox, so requires chaining with another 0day.

zahlman3 hours ago

What exactly does "RCE inside sandbox" describe that goes beyond "the webpage can supply arbitrary JavaScript and the JavaScript engine executes it", but is still isolated from the system?

StilesCrisis2 hours ago

Chrome runs webpages in individual sandbox processes with very low privileges, as a defense-in-depth strategy. It generally requires at least two exploits to actually affect a user--first, get RCE in a sandboxed process, then find a separate vulnerability that lets you escape the sandbox process entirely. For this bug to have actually been used in the wild, there was almost certainly a second bug as well.

jimrandomh2 hours ago

It means it can execute native code inside the sandbox, as opposed to Javascript. While still sandboxed, this lets it access some parts of the attack surface that JS would not have been able to, some of which may have other exploits that allow escaping the rest of the way.

jnwatson3 hours ago

It means it can execute arbitrary machine code in the sandbox.

+1
r_lee3 hours ago
+4
zahlman2 hours ago
TacticalCoder2 hours ago

> It means it can execute arbitrary machine code in the sandbox.

Well which is precisely why we have sandboxes.

To me "executing arbitrary code in the sandbox" is similar to "I don't give a flying fuck for it's what a sandbox is for".

More information is needed. As someone commented: this has to be paired with at least another exploit to make anything remotely useful.

A sandbox is a sandbox. We want to understand how "code running in a sandbox" is "actively exploited".

johnsmith18402 hours ago

Memory isolation having one tab or account open on your bank and another on this page does not mean it could leak across the sandbox and steal bank account details but anything inside of your general page content can be lost

TZubiri1 hour ago

This doesn't affect the score though, the reason there's 1.2 points less than the max is because there is a Required User Interaction. The user needs to visit a specific html page.

Even with the sandbox protection layer, the rest of the parameters are maxed out.

iririririr3 hours ago

what is online ad networks for $100, alex

jeremyjh49 minutes ago

I don't know why this is being downvoted. This is called malvertising and its one of the most significant vectors for exploiting a vulnerability like this. Its happened multiple times over the last two decades.

My read of Google's disclosure is that there is no known escape from the sandbox. I don't agree this would be reported this way just because "user action" like "using web browser" is required. Even if this individual CVE is still an 8.8 there would be a critical threat report of a known chain.

colincowardly3 hours ago

[dead]

anonymousiam3 hours ago

Just one more reason to never use Chrome. Their removal of MV2 to prevent UBlock Origin from working is another.

fidotron2 hours ago

Chrome product management is horrible. Chrome software engineering is some of the best ever done.

(And no, I don't use it except for testing).

noir_lord2 hours ago

I don’t disagree, two or more things can be true at once.

That said I still use Firefox for other reasons.

I simply don’t trust google, I don’t trust Mozilla either but I do trust them more than Google and you do kinda have to have a browser to function in the modern world.

Barbing1 hour ago

Of all the reasons to use non-Chromium browsers whenever possible(!), this isn’t really on the list.

lima2 hours ago

Which browser has a better security track record?

Cider99862 hours ago

Vanadium makes improvements on Chromium. https://grapheneos.org/features#vanadium

StilesCrisis2 hours ago

Most of those are just changing flags, not really unique development. Like "disable JIT" is a Chromium flag. "Zero-init everything" is a Clang flag.

esseph2 hours ago

Right, but it's value-add on a derivative, not its own standalone engine.

p-e-w2 hours ago

Firefox with uBlock Origin. It’s astonishing how many exploits uBO stops before they ever reach your browser engine. It’s the antivirus of the 2020s.

Cider99862 hours ago

Brave would be a much better option if you want security and good adblocking.

Alifatisk2 hours ago

I suggest Zen browser (fork of FF), it feels closer to chrome.

Barbing1 hour ago

I hear about Zen. Random q:

It can’t trick Canva into letting you use the color picker, or otherwise enable it, can it - if someone happens to know?

(What a dumb feature to be locked to the Googlesphere.)

aleksandrm1 hour ago

What does it mean "closer to chrome"?

ZiiS2 hours ago

In a good way?

StilesCrisis2 hours ago

Oh, right, because other browsers never have bugs.

paulpauper1 hour ago

chrome has more bugs, not necessarily because it's less secure, but its popularity makes it a bigger target, so more bugs are found

lta2 hours ago

If we needed any more.