Microsoft Discloses Code Execution Flaw in Chrome

itman · Oct 18, 2017

"Tit-for-Tat?"

Microsoft has disclosed the details of a remote code execution vulnerability found by its employees in the Chrome web browser. Google patched the flaw last month with the release of Chrome 61.

Microsoft’s Offensive Security Research (OSR) team analyzed Chrome’s V8 open-source JavaScript engine using ExprGen, a fuzzer developed by Microsoft for testing its own JavaScript engine, Chakra. Microsoft hoped that using ExprGen could help find some new bugs, given that publicly available fuzzers had likely already been used to test V8.

Microsoft’s tests initially led to the discovery of an information leak, which ultimately resulted in arbitrary code execution in the Chrome renderer process.

However, Chrome relies on sandboxing to ensure that web applications are executed in a restricted environment. This means that a second vulnerability, one that allows a sandbox escape, needs to be identified in order to take full and persistent control of a system.

Microsoft researchers wanted to determine how far they can go without finding a second vulnerability. They discovered that executing arbitrary code within a renderer process can be used to bypass the Single Origin Policy (SOP), which prevents a malicious script on one page from obtaining access to sensitive data on another web page.
Click to expand...

http://www.securityweek.com/microsoft-discloses-code-execution-flaw-chrome

Minimalist · Oct 19, 2017

itman said: ↑

"Tit-for-Tat?"
Click to expand...

Yes:

Microsoft also pointed out an issue with how Google releases patches for Chrome, which is based on the open-source browser project Chromium. The problem, according to Microsoft, is that source code changes that fix vulnerabilities often make it to GitHub before the actual patch is released to customers, which could give malicious actors the opportunity to exploit flaws against unprotected users.
Click to expand...

Rasheed187 · Oct 21, 2017

Seems to be payback time for M$, too bad they didn't manage to bypass Chrome's sandbox. But they still did a good job though.

Rasheed187 · Nov 11, 2017

Seems some guy found "the first critical bug" in Chrome this year, I wonder if this was a sandbox bypass? Strange that they release so little info. But I would always advice to use Sandboxie on top.

https://twitter.com/NedWilliamson/status/927718561136758788

Log in or Sign up

Microsoft Discloses Code Execution Flaw in Chrome

itman Registered Member

Minimalist Registered Member

Rasheed187 Registered Member

Rasheed187 Registered Member

Log in or Sign up

Microsoft Discloses Code Execution Flaw in Chrome

itman Registered Member

Minimalist Registered Member

Rasheed187 Registered Member

Rasheed187 Registered Member

Useful Searches