Google Patches Chrome Sandbox Escape Zero-Day Caught By Kaspersky (securityweek.com) 42
wiredmikey shares a report from SecurityWeek: Google late Tuesday rushed out a patch for a sandbox escape vulnerability in its flagship Chrome browser after researchers at Kaspersky caught a professional hacking operation launching drive-by download exploits. The vulnerability, tracked as CVE-2025-2783, was chained with a second exploit for remote code execution in what appears to be a nation-state sponsored cyberespionage campaign [dubbed Operation ForumTroll] targeting organizations in Russia.
Kaspersky said it detected a series of infections triggered by phishing emails in the middle of March and traced the incidents to a zero-day that fired when victims simply clicked on a booby-trapped website from a Chrome browser. The Russian anti-malware vendor said victims merely had to click on a personalized, short-lived link, and their systems were compromised when the malicious website was opened in Chrome. Kaspersky said its exploit detection tools picked up on the zero-day, and after reverse-engineering the code, the team reported the bug to Google and coordinated the fix released on Tuesday.
Kaspersky said it detected a series of infections triggered by phishing emails in the middle of March and traced the incidents to a zero-day that fired when victims simply clicked on a booby-trapped website from a Chrome browser. The Russian anti-malware vendor said victims merely had to click on a personalized, short-lived link, and their systems were compromised when the malicious website was opened in Chrome. Kaspersky said its exploit detection tools picked up on the zero-day, and after reverse-engineering the code, the team reported the bug to Google and coordinated the fix released on Tuesday.
A nice job by both (Score:2)
Re: A nice job by both (Score:3)
Re: (Score:1)
The nice thing is two otherwise independent companies working together.
(Something the MAGA team can only dream about)
Re: A nice job by both (Score:4, Insightful)
Uh?
Who created chrome? They created a shitty product with obvious problems, ignored them. Congratulated and joyfully announced they fixed a problem they created and someone else exploited it. For christ's sake, all you have to do is click a link and the computer is pwned. Nothing happens to the incompetent corporation and all its users are the ones that are screwed. If that isn't american capitalism in a nutshell.
Re: (Score:2)
ALL software can have bugs, the difference is who and how fast fixes it.
Re: (Score:2)
They create the problem and pat themselves on the back, while announcing how great they are for doing it.
To be fair, that's Trump's SOP ...
A level of incompetence that Hegseth only knew.
Also, to be fair, National Security Advisor Michael Waltz set up the Signal group chat and (accidentally) invited The Atlantic journalist Jeffrey Goldberg to join. Pete Hegseth (apparently) just blabbed details of the military activities and John Ratcliffe, Director of the CIA (apparently) blabbed the name of an active intelligence officer. So, to your point, several people (apparently) know that level of incompetence. Also, to be fair, it's possible they all thought "J
Re: (Score:2)
Yes, a nice job, and since the US gov has banned Kaspersky, I bet that they have targeted their 0-day-finding resources to weaknesses specifically exploited by Western governments. The "nation-state sponsored cyberespionage campaign targeting organizations in Russia." is a clue.
Sad reality (Score:4, Interesting)
For years I've been thinking about moving my browsers into a VM, but I've never done it because the web has gotten so heavy that doing so will result in much higher CPU/RAM consumption, and what's worse, VMs don't support HW-accelerated video decoding, so this will be even worse.
I just hope I'll never be a target of such exploits and I'm under Linux which is being targeted less than e.g. Windows and MacOS.
Perhaps web browsers need to become virtual machines themselves.
Re:Sad reality (Score:4, Informative)
Virtualbox can do video acceleration with your GPU. I believe proxmox can do that as well.
Best,
Re: (Score:2)
According to VirtualBox documentation video decoding acceleration works only if both [virtualbox.org] your host and guest are Windows 10/11 and I'm a Linux user:
Re: (Score:2)
I also thought to get this you needed the non-free extension pack or whatever it's called, at least for commercial use?
Don't use Chrome (Score:3)
Re:Don't use Chrome (Score:4, Insightful)
But ... (Score:1)
Re: (Score:1)
I understand there is great irony and hypocrisy in US/NATO/Ukr's Russian security policy against a Russian security company that helped an American company fix a security vulnerability attacking Russia from presumably US/NATO/Ukr.
But perhaps you can explain "un-personed"?
Re: (Score:3, Interesting)
But perhaps you can explain "un-personed"?
It's what "conservative" fascists (who believe corporations are people, which is literally the most fascist view possible) say people are doing to them and theirs, while they simultaneously aggressively describe actual humans as less than people in order to try to emotionally and mentally manipulate others into agreeing with their twisted, selfish world view.
Re: (Score:2)
Might I suggest that you know your government is corrupt and perhaps you know that most or all politicians are corrupted.
Corruption is not a boolean, but sure.
Believing in a right-left dichotomy is exactly what the powerful and rich want us to believe.
No, that's fucking bullshit stem to stern. Left and right are real, and the so-called right is wrong about literally everything from human rights (yes, they are good) to fiscal policy (no, austerity doesn't work and allowing the wealthy to own everything is not sustainable.) People don't become more left-leaning when they are more educated because of indoctrination, it's because they can understand what a failure conservative policies are.
Dems or "liberals" as one may categorize them are just as "fascist"
Only big fucking idiots think t
Re: (Score:2)
And Obama condemned the decision almost immediately in his State of the Union address. The President doesn't inherently control the Supreme Court (and in principle shouldn't, because of the separation of powers, although with strong support in the Senate they can pack it).
Re: (Score:2)
Citizens United (2010), I suppose.
Citizens United passed the Supreme Court 5-4 under Obama. Kaspersky was banned under Biden.
That's a lot of words for "both sides".
Please say you understand that Obama didn't appoint all 9 supreme court justices on the rulings during his presidency. He's not trump. He didn't game the system to keep seats open so he could rule like a king.
Re: (Score:2)
Re: (Score:2)
Corporations were invented during the Roman Empire as a means for a group of people to act as one single legal person. It is the literal definition of the word
Corporations are not people, and do not need the rights of people. If you think emulating the Roman empire is a good idea, perhaps you should take a look at how and why it ended.
Re: (Score:1)
But to the point, and again, you are arguing against the formal, consistent, and ancient definition of the term. You can dig in your heels and cry about how you don't want it to be so, but the word will still mean what it means.
Re: (Score:2)
Re: (Score:2)
Even in western law, corporations used to have to justify their existence [context.org] to get a charter, by appealing to the public interest.
Now your charter can be solely about enhancing shareholder value, and most types of corporation can be founded by mail by any jerkoff with the money and the ability to complete the paperwork.
Re: (Score:1)
Don't put too much stock in that opinion piece you linked. It is an argument, not context. Not a great argument either. A lousy one, really. Hell, it ignores something like 600 years of pre-British history, ignores some major commercial corporations that did exist in the timeframe he begins, conflates Trusts and Corporations as it gets closer to the modern era, and
Re: (Score:1)
Before the early 1900's, Trusts were more commonly used for business purp
Re: (Score:1)
... I thought we had un-personed Kaspersky?
And in reply ... various political fulminations, lol!
Yeah, wow, that sure disproves my point ...
Does it still run as root? (Score:2)
I don't know if its still the case - I no longer use chrome - but the chrome sandbox on linux used to have to run with root privs. Which its great until someone finds an exploit in it, then not so much.
Meanwhile other browsers sensibly just run under the uid of whichever user started the process.
Re:Does it still run as root? (Score:4, Informative)
Re: (Score:2)
"has actually made it a lot more secure vs. it running as a normal user process"
Yeah right, believe that if it makes you feel better. Using that logic why not run all programs on *nix as root?
Re: (Score:2)
Chrome is not running as a root user. The helper exists only to drop even more privileges and it ceases to exist once you've launched the application. There's nothing to exploit.
You can run `ps faxu`, `top` or SysInternals Process Explorer to see it for yourself.
Re: (Score:2)
FFS , the sandbox is running as root. Do try and keep up.
Re: (Score:2)
Meanwhile other browsers sensibly just run under the uid of whichever user started the process.
Web browsers -- any programs, really -- having access to all the files in a user's home directory by default also seems like a huge security issue...
Re: (Score:2)
Better just the users files than write access to the entire system.
Kapersky is Not America's Friend (Score:2)