What about 0.0.0.0 Day in Vanadium

klittle

What can we expect with the "0.0.0.0 Day" vulnerability which I assume also affects Vanadium, because it's based on Chromium? I must say I don't know what the exact attack surface of this vulnerability is for GrapheneOS devices but I know I'd definitely sleep better at night knowing Vanadium isn't vulnerable.

Xtreix

klittle Note that Firefox is also affected.

I don't know how problematic this flaw could be for a GrapheneOS user, I don't know the attack surface or whether it exists in this context in the first place.

wuseman https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser, https://chromestatus.com/feature/5106143060033536, https://github.com/whatwg/fetch/pull/1763

wuseman

What the hell is a 0.0.0.0 day?

Spasiba

I have no idea if/how Vanadium guards against this or if this is even an issue on GrapheneOS or Android.

But on a computer (where this is certainly an issue), in a browser with uBlock Origin, you can activate a filter list. The list is included in uBlock Origin. In Settings, go to Filter Lists, the Privacy section, and make sure 'Block Outsider Intrusion into LAN' is selected. See 3np's comment and replies on this HN thread for more info and links.

Spasiba

Vanadium already now includes some Easylist content filtering, i.e. via a filter list. 'Block Outsider Intrusion into LAN' is a filter list with the same syntax, so possibly it is or it could be integrated in Vanadium. I sure hope it is