back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member

[thermia@sk.girlthi.ng]

@rebane2001@infosec.exchange oh ​​

[rebane2001@infosec.exchange]

even worse, edge no longer even makes the download menu pop up, so it's completely silent js rce that keeps running even after you close the browser !!

all from just visiting a single website once !!

[rebane2001@infosec.exchange]

@atjn oh no..

[9pfs@tilde.zone]

@rebane2001 would the service worker process stay around even without the main browser process with edge?

[atjn@mastodon.online]

@rebane2001 I guess it's a good thing I asked

[4censord@unfug.social]

@rebane2001 hmm I can't see that bug report, it just promts me to sign in

[rebane2001@infosec.exchange]

@9pfs no, but the main process stays running even after closing all visible windows

[rebane2001@infosec.exchange]

@4censord works for me on a fresh session, might have to wait for it to load?

[kotsune@sakurajima.moe]

@rebane2001 So much for Edge having “the added trust of Microsoft”.

[natty@astolfo.social]

@rebane2001@infosec.exchange Oh no the second I saw the download bit I knew it's gotta be content-disposition

Sneaky

[4censord@unfug.social]

@rebane2001 hmm, nothing is loading for me, I've waited around 30s
There is also no loading indicator.
I'm using a similar browser as well, its also Firefox klar

[natty@astolfo.social]

@4censord@unfug.social @rebane2001@infosec.exchange Klar is a Germany-specific thing, it might have different rules

[rebane2001@infosec.exchange]

@natty @4censord mine's firefox focus

[4censord@unfug.social]

@rebane2001 @natty they are very similar afaik, mostly branding because Germany has another established thing called "focus"

But I'll retry in fennec in a sec

[henry_null@sueden.social]

@rebane2001 Is this what they call a 1259 day?

[edcates@mastodon.social]

@henry_null @rebane2001 Cue Microsoft issuing a press release accusing Rebane of "violating coordinated vulnerability best practices." They've barely had time to react, after all...

[multisn8@mastodon.catgirl.cloud]

@rebane2001 the bot ghost is providing emotional support here

Uh oh! This issue still open and hasn't been updated in the last 262 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

[cr0w@infosec.exchange]

@rebane2001 I've got a dumb question: Is this something that can be mitigated with a uBlock filter? It reads like it could be but I don't know this stuff well.

[rebane2001@infosec.exchange]

@cR0w no

[mirq@tsogol.tsiran.org]

@rebane2001 uh oh
Why did it take them 4 years to (not) fix this?
I really should go ahead and disable js everywhere