Isn't this exactly why there is a sandbox? What can the RCE actually do or obtai...

socalgal2 · 2026-09-05T04:36:32

Yes, it says right in the CVE

> allowed a remote attacker to execute arbitrary code *inside the sandbox*

mikeweiss · 2026-09-05T18:24:24

So then what's the big deal? If you had JavaScript turned off it would allow code to run in the sandbox anyway?

nikanj · 2026-09-05T17:20:10

Doesn’t any <script> tag let you run arbitrary code inside a sandbox anyway?

lima · 2026-09-06T07:03:00

Inside the JS sandbox, not the browser's outer containment sandbox.