Hacker News Reader

The idea here would be that I'm visiting Reddit, someone uploads a malicious WebP, and now my Reddit account is owned, right?

View on HN

Sites like Reddit load user uploaded content from different domains (redditmedia.com) so you should be safe in this case.

I'm not that familiar with Chrome's process isolation but I think that the renderer process that displays your Reddit.com tab would still render that image, even if it came from a different domain.

Chrome doesn't spin up another process to render the image and then transfer the pixels.

Wouldn’t the exploit code be able to bypass all those cross domain checks? As long as they are running in the same sandbox, right?

It should be noted that some sites (not sure about reddit) will re-encode images in various ways (sometimes to entirely different formats), possibly mitigating this.

Exploits aside, there are quite a few undesirable behaviours you can cause with media, such as the bouncing video file which changes it's height every frame and makes content around it reflow.

TBH I just used Reddit as an example of "site with images", I'm not actually concerned about my Reddit account/ think it'd be a good target.

Reply on news.ycombinator.com