Comment by ARandomerDude
Comment by ARandomerDude 10 months ago
I'm amazed by how profoundly stupid this vulnerability is. To get arbitrary code execution, you literally just send somebody else's user ID, which is fairly trivial to obtain.
I don't work at FAANG. I just work at some company that makes crap products you don't actually need, and even I would never build this kind of bug.
But these people want to build a web browser, with all the security expertise and moral duty that implies?! Wow.
Can you explain how you could get someone else's user id? I get that this is still a big vulnerability but am trying to understand how that would happen.