The Chrome sandbox is a browser security boundary that prevents remote code execution vulnerabilities from launching programs on the host computer.įor Agarwal's zero-day RCE exploit to work, it would need to be chained with another vulnerability that can allow the exploit to escape the Chromium sandbox. While no developer likes a zero-day release for their software, the good thing is that Agarwal's zero-day cannot currently escape the browser's sandbox. When the PoC HTML file, and its corresponding JavaScript file, are loaded in a Chromium-based browser, it will exploit the vulnerability to launch the Windows calculator (calc.exe) program. While Agarwal states that the vulnerability is fixed in the latest version of the V8 JavaScript engine, it is not clear when Google will roll out the Google Chrome. Today, security researcher Rajvardhan Agarwal released a working proof-of-concept (PoC) exploit for a remote code execution vulnerability for the V8 JavaScript engine in Chromium-based browsers. A security researcher has dropped a zero-day remote code execution vulnerability on Twitter that works on the current version of Google Chrome and Microsoft Edge.Ī zero-day vulnerability is a security bug that has been publicly disclosed but has not been patched in the released version of the affected software.
0 kommentar(er)
