Chrome OS Dev Update Brings File System Support, More Experiments

http://www.thechromesource.com/chrome-os-dev-update-brings-file-system-support-more-experiments/

by dcawrey • 16 years ago

11 4 16 years ago

ezalor2• 16 years ago

This is not that exciting: a malicious XSS or CSRF and PAF! an attacker writes on the user filesystem!

Groxx2• 16 years ago

You seem to be implying that the browser that first made window, tab, and plugin sandboxing into a big deal won't sandbox such systems from normal operation.

ie, it's likely to be exactly as vulnerable as your computer. If you open a vulnerability in your extension and someone exploits it, it's the same as a flawed program that allows input being attacked. If they eval JS from arbitrary sites, that has nothing to do with the security of the system, only the security of what you installed.

ezalor2• 16 years ago

Obvious difference: I expect not to get my HDD corrupted because I visited an arbitrary website, I understand it might be the case if I download AND run an arbitrary program.

Chrome OS Dev Update Brings File System Support, More Experiments

Related Stories