back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member

[edcates@mastodon.social]

@henry_null @rebane2001 Cue Microsoft issuing a press release accusing Rebane of "violating coordinated vulnerability best practices." They've barely had time to react, after all...

[multisn8@mastodon.catgirl.cloud]

@rebane2001 the bot ghost is providing emotional support here

Uh oh! This issue still open and hasn't been updated in the last 262 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

[cr0w@infosec.exchange]

@rebane2001 I've got a dumb question: Is this something that can be mitigated with a uBlock filter? It reads like it could be but I don't know this stuff well.

[rebane2001@infosec.exchange]

@cR0w no

[mirq@tsogol.tsiran.org]

@rebane2001 uh oh
Why did it take them 4 years to (not) fix this?
I really should go ahead and disable js everywhere

[taghunt@infosec.exchange]

@rebane2001 well that's not good...

[henry_null@sueden.social]

@EdCates @rebane2001 I mean its them who made it public first I guess https://issues.chromium.org/issues/40062121#comment56

[interpipes@thx.gg]

@rebane2001 ‍️

[utf_7@mastodon.social]

@henry_null @rebane2001

i second this, sent from my epiphany

[gurkan@has.siktir.in]

@rebane2001 peak google efficiency

[egerlach@hachyderm.io]

@rebane2001 Clearly, @mozilla's choices around not implementing certain APIs is paying off.

[skyr@chaos.social]

@rebane2001 BeEF module ftw!

[rebane2001@infosec.exchange]

issue set to private again, hopefully it'll get fixed properly this time

[sylvhem@eldritch.cafe]

@rebane2001 Oops.

[alesandroortiz@infosec.exchange]

@rebane2001 Nice find! I should have woken up earlier to see the details.

[ratsnakegames@mastodon.social]

@rebane2001 fucking embarrassing

[samantazfox@infosec.exchange]

@rebane2001 Well, too late, it has already been archived :x

[rebane2001@infosec.exchange]

@SamantazFox out of curiosity, where? the archive.org captures don't load for me

edit: ty

[lenni@fosstodon.org]

@rebane2001 @SamantazFox It's on archive.today/.is/.ph. Only go there with a content blocker, you're DDoSing a small blog otherwise: https://gyrovague.com/2026/02/01/archive-today-is-directing-a-ddos-attack-against-my-blog/

[fuzzyfuzzyfungus@cyberplace.social]

@rebane2001 I hate it; but damn that's clever.