back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member

[4censord@unfug.social]

@rebane2001 hmm, nothing is loading for me, I've waited around 30s
There is also no loading indicator.
I'm using a similar browser as well, its also Firefox klar

[natty@astolfo.social]

@4censord@unfug.social @rebane2001@infosec.exchange Klar is a Germany-specific thing, it might have different rules

[rebane2001@infosec.exchange]

@natty @4censord mine's firefox focus

[4censord@unfug.social]

@rebane2001 @natty they are very similar afaik, mostly branding because Germany has another established thing called "focus"

But I'll retry in fennec in a sec

[henry_null@sueden.social]

@rebane2001 Is this what they call a 1259 day?

[edcates@mastodon.social]

@henry_null @rebane2001 Cue Microsoft issuing a press release accusing Rebane of "violating coordinated vulnerability best practices." They've barely had time to react, after all...

[multisn8@mastodon.catgirl.cloud]

@rebane2001 the bot ghost is providing emotional support here

Uh oh! This issue still open and hasn't been updated in the last 262 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

[cr0w@infosec.exchange]

@rebane2001 I've got a dumb question: Is this something that can be mitigated with a uBlock filter? It reads like it could be but I don't know this stuff well.

[rebane2001@infosec.exchange]

@cR0w no

[mirq@tsogol.tsiran.org]

@rebane2001 uh oh
Why did it take them 4 years to (not) fix this?
I really should go ahead and disable js everywhere

[taghunt@infosec.exchange]

@rebane2001 well that's not good...

[henry_null@sueden.social]

@EdCates @rebane2001 I mean its them who made it public first I guess https://issues.chromium.org/issues/40062121#comment56

[interpipes@thx.gg]

@rebane2001 ‍️

[utf_7@mastodon.social]

@henry_null @rebane2001

i second this, sent from my epiphany

[gurkan@has.siktir.in]

@rebane2001 peak google efficiency

[egerlach@hachyderm.io]

@rebane2001 Clearly, @mozilla's choices around not implementing certain APIs is paying off.

[skyr@chaos.social]

@rebane2001 BeEF module ftw!

[rebane2001@infosec.exchange]

issue set to private again, hopefully it'll get fixed properly this time

[sylvhem@eldritch.cafe]

@rebane2001 Oops.

[alesandroortiz@infosec.exchange]

@rebane2001 Nice find! I should have woken up earlier to see the details.