[mhh__]

What kind of exploits? Was the browser not isolated at all or was it (say) sandbox-escaping via the JS?

[dleslie]

We posted this:

https://medium.com/@vrchat/security-update-web-panels-4699fa...

It was severe enough that I ripped them out, though we were unable to find any evidence of the vulnerability in use.

[mmmkkaaayy]

But what was the vulnerability? It's not mentioned in the post.

[dleslie]

It's been a few years, and I can't recall the specifics with certainty. It was a serious Chromium SVE that was unpatched in the middleware we were using.