Comment by JumpCrisscross

Comment by JumpCrisscross a year ago

> $2,000 is a tiny fraction of what this bug is worth

The Browser Company raises $50mm at a $550mm post-money valuation in March [1]. They’ve raised $125mm altogether.

Unless they’re absolute asshats, they’ll increase the bug payout. But people act truly when they don’t think they’re being watched—a vulnerability of this magnitude was worth $2k to this company. That’s…eyebrow raising.

[1] https://techcrunch.com/2024/03/21/the-browser-company-raises...

shuckles a year ago

"We will let anyone run arbitrary JavaScript on all your web pages if you send them a referral link" is surely a 6-7 figure vulnerability for a web browser. That this vulnerability was discoverable using about two steps of analysis tools suggests many more issues are in the product.

Reply View 5 replies

rafram a year ago

Not just that - seems like it allowed running privileged JavaScript (full access to your system) on the preferences page as well.

Reply View | 4 replies
- voiceblue a year ago
  
  It is very strange to me that their attitude is "no one was impacted" and this is "hypothetical". Any serious company would immediately consider this to be a case where everyone was impacted! This is like coming home to the worst neighborhood on the planet to find your door wide open, and immediately putting on a blindfold so you can continue to pretend nothing's changed.
  
  Reply View | 3 replies
  
  DecoySalamander a year ago
  
  Since everything is stored in their DB, they supposedly can audit logs and sources for boosts themselves to confirm if anyone was actually impacted.
  
  Reply View | 2 replies

cutemonster a year ago

They have more users than what I could have guessed:

> As of July 2023, The Browser Company has 100,000+ users

https://www.boringbusinessnerd.com/startups/the-browser-comp....

Reply View 0 replies

behringer a year ago

It doesn't matter what bug bounty pay pay. If it was 200k people would say it's not enough.

Reply View 0 replies