[mpeg]

"Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera."

That's pretty bad! I wonder what kind of bounty went to the researcher.

[duozerk]

> That's pretty bad! I wonder what kind of bounty went to the researcher.

I'd be surprised if it's above 20K$.

Bug bounties rewards are usually criminally low; doubly so when you consider the efforts usually involved in not only finding serious vulns, but demonstrating a reliable way to exploit them.

[clucas]

Here is a comment that really helped me understand bug bounty payouts: https://news.ycombinator.com/item?id=43025038

[naeioi]

The bounty could be very high. Last year one bug’s reporter was rewarded $250k. https://news.ycombinator.com/item?id=44861106

[salviati]

I think a big part of "criminally low" is that you'll make much more money selling it on the black market than getting the bounty.

[wepple]

> but demonstrating a reliable way to exploit them

Is this a requirement for most bug bounty programs? Particularly the “reliable” bit?

[bicepjai]

So basically Firefox is not affected ?

[hdgvhicv]

The listed browsers are basically skins on top of the same chromium base.

It’s why Firefox and Safari as so important despite HN’a wish they’d go away.

[zozbot234]

Firefox is safe from this because their CSS handling was the first thing they rewrote in Rust.

[jsheard]

Firefox and Safari are fine in this case, yeah.

[vntok]

No, though Firefox has its own CVE this week: https://thecyberexpress.com/firefox-v147-cve-2026-2447/

[DetroitThrow]

It's pretty hard to have an accidental a use after free in the FireFox CSS engine because it is mostly safe Rust. It's possible, but very unlikely.

[dzhiurgis]

Yes, because nobody uses it

[deanc]

Presumably this affects all electron apps which embed chrome too? Don’t they pin the chrome version?

[comex]

Yes, but it's only a vulnerability if the app allows rendering untrusted HTML or visiting untrusted websites, which most Electron apps don't.

[pjmlp]

Yeah, but lets keeping downplaying use-after-free as something not worth eliminating in 21st century systems languages.

[pheggs]

I love rust but honestly I am more scared about supply chain attacks through cargo than memory corruption bugs. The reason being that supply chain attacks are probably way cheaper to pull off than finding these bugs

[ceteia]

https://materialize.com/blog/rust-concurrency-bug-unbounded-...

Edit: Replying to ghusbands:

'unsafe' is a core part of Rust itself, not a separate language. And it occurs often in some types of Rust projects or their dependencies. For instance, to avoid bounds checking and not rely on compiler optimizations, some Rust projects use vec::get_unchecked, which is unsafe. One occurrence in code is here:

https://grep.app/pola-rs/polars/main/crates/polars-io/src/cs...

And there are other reasons than performance to use unsafe, like FFI.

Edit2: ghusbands had a different reply when I wrote the above reply, but edited it since.

Edit3: Ycombinator prevents posting relatively many new comments in a short time span. And ghusbands is also wrong about his answer not being edited without him making that clear.

[StilesCrisis]

It would also require a sandbox escape to be a meaningful vulnerability.

Unfortunately, "seen in the wild" likely means that they _also_ had a sandbox escape, which likely isn't revealed publicly because it's not a vulnerability in properly running execution (i.e., if the heap were not already corrupted, no vulnerability exists).

[staticassertion]

I'd bet that the sandbox escape is just in the underlying operating system kernel and therefor isn't a matter for Chromium to issue a CVE.

[waynesonfire]

"Actually, you forgot Brave."

[mpeg]

I quoted directly from NIST, there's many other browsers and non-browsers that use chromium