[devwastaken]

Exactly this. Vrchat had chromium for a while, but exploits got it removed. Itd be great if it was just a static browser engine, no Js, with a strong sandbox. So at most all that can be done is messing with the browsers runtime memory itself, not the system it's on.

[dleslie]

Heh, that's why I asked. I'm one of the developers of VRChat.

[mhh__]

What kind of exploits? Was the browser not isolated at all or was it (say) sandbox-escaping via the JS?

[dleslie]

We posted this:

https://medium.com/@vrchat/security-update-web-panels-4699fa...

It was severe enough that I ripped them out, though we were unable to find any evidence of the vulnerability in use.

[mmmkkaaayy]

But what was the vulnerability? It's not mentioned in the post.

[dleslie]

It's been a few years, and I can't recall the specifics with certainty. It was a serious Chromium SVE that was unpatched in the middleware we were using.