> And after all that, all it can do is run a search query. It can't leak all your Gmail emails or exploit the local machine.
Doesn't that contradict the following?
> “However, because the IPC channel was exposed to JS directly in New Tab page, the XSS in Chrome’s NTP can be treated as the equivalent of renderer process RCE.”
Doesn't that contradict the following?
> “However, because the IPC channel was exposed to JS directly in New Tab page, the XSS in Chrome’s NTP can be treated as the equivalent of renderer process RCE.”