Hacker News Reader

Comment by krageon | Hacker News Reader

Chromium has a working exploit (AFAIK it still is not patched) that allows third-party code to masquerade as first-party code. Unless you run a special addon[1], you are vulnerable to this.

The fact that I still can't find that it's patched now tells me nothing good about the health of the ecosystem and who it is meant to serve. That should be all the reason you need to switch to Firefox, which admittedly also has huge warts but to my mind ones that aren't quite so egregious.

[1] https://chrome.google.com/webstore/detail/ublock-origin-extr...

View on HN

You make it sound like it's a third-party RCE; but it's a cookie bypass, so it's tracking -- that's serious still [and the implementation sounds illegal to me].

The companies Instart Manager (used by cnet, tomshardware, etc., see link) and Upmanager that are doing this workaround of ublock -- are they not able to attack other browsers, only Chromium? I guess one benefit of being the biggest advertising company is that people don't want to mess with Google's stuff in case they suffer financial repercussions.

https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO...

> workaround of ublock

This has nothing to do with ublock origin specifically, ublock origin's author just happens to have a band-aid for this exploit. Assuming I don't misunderstand what is happening, any other blocking plugin is vulnerable as well.

> people don't want to mess with Google's stuff

I don't understand what you're saying. Chromium is vulnerable and by extension, so is Chrome.

Edit:

> You make it sound like it's a third-party RCE

I don't think I am. I said third-party code looks like first-party code, that is precisely what is happening.

>third-party code

It's third-party cookies, look like first-party cookies, isn't it? Whilst they are "code", that's misleading because it's not being executed; which is what makes it sound like an RCE.

Or did my brief scan pick up the wrong idea?

> Or did my brief scan pick up the wrong idea?

I believe so. To quote: "The purpose of Instart Logic technology is to disguise 3rd-party requests as 1st-party requests"

The net result of this is also that third-party javascript will get loaded as if it is first-party. Third-party content will look like first-party content in it's entirety. This subverts any potential security features that rely on being able to distinguish a first party from a third party.

Edit: As an example you can read https://www.w3.org/Security/wiki/Same_Origin_Policy

Thanks for persisting in your explanation.

Wow this is... scary and you say it is still not patched? Thank you.

Reply on news.ycombinator.com