Windows, Chrome Zero-Days Chained in Operation WizardOpium Attacks December 10, 2019 https://www.bleepingcomputer.com/ne...ays-chained-in-operation-wizardopium-attacks/ Kaspersky: Windows 0-day exploit CVE-2019-1458 used in Operation WizardOpium
Microsoft Zaps Actively Exploited Zero-Day Bug December 10, 2019 https://threatpost.com/microsoft-actively-exploited-zero-day-bug/150992/
You see, this is what I'm talking about. If you combine this RCE bug with a Windows zero day, you can break out of the browser's sandbox. However, you don't need a Windows zero day for this, sometimes people also find bugs in the browser itself that can bypass the sandbox. This applies to both Chrome and Firefox. But this doesn't mean malware will also bypass a sandbox running on top like Sandboxie.
I don't believe this will block all exploits. And yes we can block all JS on websites, but this will also break almost all sites, so let's don't go there.
That's nonsense. It doesn't break most sites. Very few in fact. And blocking 3rd-party scripts and iframes will block numerous exploits. Not all, of course, but many of them.
I think you need to read better. I said if you block all JS it will break most websites, that's a fact. I was not talking about blocking XSS. And yes, I guess you're right about blocking 3rd party scripts and iframes.
I mentioned this, because blocking all first party scripts is yet another way to block exploits. But it's not very user friendly one. In theory you could lure users into a certain site that will then exploit the browser via first party scripts, and blocking XSS and third party scripts won't help then.
