Rebanerebane2001@infosec.exchange
May 20, 2026, 12:12 PMOH NO I JUST REALIZED THIS IS NOT ACTUALLY PROPERLY FIXED AND STILL WORKS 💀💀
Replies
- Rebanerebane2001@infosec.exchangeMay 20, 2026, 12:25 PM
even worse, edge no longer even makes the download menu pop up, so it's completely silent js rce that keeps running even after you close the browser !!
all from just visiting a single website once !!
- Rebanerebane2001@infosec.exchangeMay 20, 2026, 3:21 PM
issue set to private again, hopefully it'll get fixed properly this time :p
Henryhenry_null@sueden.socialMay 20, 2026, 12:17 PM@rebane2001
oooof, thats not good😬
3,5 years...sent from my firefox
�utf_7@mastodon.socialMay 20, 2026, 2:38 PMi second this, sent from my epiphany
May 20, 2026, 7:26 PM@utf_7 @henry_null @rebane2001 fellow rare #GNOME Web user found in the wild
Regalia :neodog_science: hellbeast@pleroma.envs.netMay 20, 2026, 12:17 PM@rebane2001 oops, happy
0day4year to those who celebrate
May 20, 2026, 12:18 PM@rebane2001@infosec.exchange oh :overjoyed:
May 20, 2026, 12:32 PM@rebane2001 I guess it's a good thing I asked 😂
Kotsunekotsune@sakurajima.moeMay 20, 2026, 12:37 PM@rebane2001 So much for Edge having “the added trust of Microsoft”.
- Henryhenry_null@sueden.socialMay 20, 2026, 1:09 PM
@rebane2001 Is this what they call a 1259 day?
EdEdCates@mastodon.socialMay 20, 2026, 1:39 PM@henry_null @rebane2001 Cue Microsoft issuing a press release accusing Rebane of "violating coordinated vulnerability best practices." They've barely had time to react, after all...
- Henryhenry_null@sueden.socialMay 20, 2026, 2:04 PM
@EdCates @rebane2001 I mean its them who made it public first I guess🤷 https://issues.chromium.org/issues/40062121#comment56
Bob K Mertz :distressedUS:bobkmertz@techhub.socialMay 22, 2026, 5:28 AM@EdCates
Then demanding that @GossiTheDog remove the account from all of the Fediverse
https://cyberplace.social/@GossiTheDog/115174005290146637
@henry_null @rebane2001
May 20, 2026, 1:59 PM@rebane2001 uh oh
Why did it take them 4 years to (not) fix this?
I really should go ahead and disable js everywhere
TagHuntTagHunt@infosec.exchangeMay 20, 2026, 2:02 PM@rebane2001 well that's not good...
Skyrskyr@chaos.socialMay 20, 2026, 3:12 PM@rebane2001 BeEF module ftw! 🎉
EldeberenEldeberen@social.middleearth.frMay 20, 2026, 3:16 PM@rebane2001 Service Workers working as intended… :|
Alesandro Ortiz 🇵🇷🏳️🌈AlesandroOrtiz@infosec.exchangeMay 20, 2026, 3:34 PM@rebane2001 Nice find! I should have woken up earlier to see the details. 😅
Sophie of Ratsnake Gamesratsnakegames@mastodon.socialMay 20, 2026, 3:36 PM@rebane2001 fucking embarrassing
Samantaz FoxSamantazFox@infosec.exchangeMay 20, 2026, 3:43 PM@rebane2001 Well, too late, it has already been archived :x
- Rebanerebane2001@infosec.exchangeMay 20, 2026, 4:04 PM
@SamantazFox out of curiosity, where? the archive.org captures don't load for me
edit: ty :)
May 20, 2026, 4:06 PM@rebane2001 @SamantazFox It's on archive.today/.is/.ph. Only go there with a content blocker, you're DDoSing a small blog otherwise: https://gyrovague.com/2026/02/01/archive-today-is-directing-a-ddos-attack-against-my-blog/
May 20, 2026, 5:25 PM@Lenni @rebane2001 @SamantazFox
Archive.today is rolling out Google's QR reCaptcha as well paired with altering snapshots, seems like potential vector for a bad time.
River, Cachorrín de Los AndesPuppyFromLosAndes@kolektiva.socialMay 20, 2026, 9:39 PM@milagemayvary @Lenni @rebane2001 @SamantazFox
archive.org has already scrubbed archives of incriminating words by sex offenders like Andrew Tate, Vitalik Butterin, and a DOGE staffer, so really, who can I wing for?
- May 20, 2026, 10:55 PM
@PuppyFromLosAndes @Lenni @rebane2001 @SamantazFox
I assume we're speaking of Kiwi Farms?
Is it scrubbed from archive.org, or is it present for research purposes?
I would assume they have kept the data, I think they would respond to a subpoena with the snapshot.
After about 10 minutes of searching, I'm not entirely sure if archive.today has been used as admissable evidence in a court room let alone successfully.
IANAL, I feel like this is a legal quagmire & legally safer to exclude?
May 20, 2026, 11:13 PM@Lenni @rebane2001 @SamantazFox
I do genuinely wonder why the blog's author is so interested in doxing the archive.is's operator?
The response of getting DDoS:ed by the operator does also make it look like they hit close.
Shravan Ravi Narayanshravanrn@infosec.exchangeMay 20, 2026, 4:27 PM@rebane2001 really cool work. Didn't realize this sort of bug class even existed. Hope they up the bounty; this seems worth more than $1000
VissViss@mastodon.socialMay 20, 2026, 10:25 PM@rebane2001 could you test vivaldi? :D
Seanseanm@infosec.exchangeMay 21, 2026, 12:02 AM@Viss @rebane2001 it's mentioned in an Ars Technica article that Vivaldi is also vulnerable.
>Other browsers Rebans confirmed as vulnerable include Brave, Opera, Vivaldi, and Arc.
- VissViss@mastodon.socialMay 21, 2026, 12:10 AM
@seanm @rebane2001 spectacular
yoasifyoasif@mastodon.socialMay 22, 2026, 8:20 PM@Viss @rebane2001 Vivaldi is Chromium, why do people think Chromium issues don't apply to it?
May 20, 2026, 7:03 PM@rebane2001 So they have fixed the bug. The one with the download menu popping up during eval.
- VissViss@mastodon.socialMay 20, 2026, 10:17 PM
@rebane2001 fucking spectacular.
RoboMWMRoboMWM@robomwm.comMay 21, 2026, 11:18 AM@rebane2001 if you disable running in background in edge does it still run if closed?
Interpipes 💙interpipes@thx.ggMay 20, 2026, 2:06 PM@rebane2001 🤦♂️
May 20, 2026, 2:38 PM@rebane2001 peak google efficiency
SylvhemSylvhem@eldritch.cafeMay 20, 2026, 3:22 PM@rebane2001 Oops.
Cyril BruleboisCyrilBrulebois@mamot.frMay 20, 2026, 5:56 PM@rebane2001 @zhenech Emotional (and security) rollercoaster, full steam ahead…
firekeeperfirekeeper@b0nfire.xyzMay 20, 2026, 7:57 PM@rebane2001@infosec.exchange
Hmmm....
"If I boost this, more hackers will know about the exploit, but also, more affected people may be attacked..."
boost
They installed it, yolo.- River, Cachorrín de Los AndesPuppyFromLosAndes@kolektiva.socialMay 20, 2026, 9:35 PM
Pfffrrrrsssshhh.
Even the "most secure web browser" ends up being just as incompetent as the rest.
May 20, 2026, 10:29 PM@rebane2001 lol
cancelcancel@merveilles.townMay 20, 2026, 10:39 PM@rebane2001 I am once again vindicated for having service workers blocked with uBlock
FOSS-Daily!fossdaily@fosstodon.orgMay 22, 2026, 6:50 AM@rebane2001 well that doesn't look too good for chromium based browser