Diese Liste ist nicht vollständig / korrekt (Rahmenvereinbarung vs Abruf von Leistungen) aber zeigt ungefähr die Größenordnungen
offenevergaben.at/lieferanten/...
Florian Schweitzer
@flosch.bsky.social
603 followers 554 following 538 posts
IT Security Consultant | Cloud Security Expert | Hacker | Activist | Previously: Greenpeace, European Parliament Vienna, Austria/EU
![Screenshot: NOTE: This is an automatically generated email
Hello,
Chrome Vulnerability Rewards Program (VRP) Panel has decided to issue a reward of $[redacted] for your report. Congratulations!
Rationale for this decision:
UAF
Important payment guidance:
Legacy: If you aren't already registered with Google as a supplier, [redacted]@google.com will reach out to you. If you have registered in the past, no need to repeat the process – you can sit back and relax, and we will process the payment soon.
If you have any payment related requests, please direct them to [redacted]@google.com. Please remember to include the subject of this email and the email address that the report was sent from.
Thank you for your efforts and helping us make Chrome more secure for all users!
Cheers, Chrome VRP Panel Bot](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:jhpu65fmdl4lm2aann5pjjyl/bafkreian324hppzhjv5skua5m7fuindiybrsqnldjhpnc44rpryzazvmue)
![Screenshot Chrome Release Blog:
"This update includes 16 security fixes. Please see the Chrome Security Page for more information.
[TBD][500417361] Critical CVE-2026-93374: Use after free in Dawn. Reported by Florian Schweitzer on 2026-04-08"](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:jhpu65fmdl4lm2aann5pjjyl/bafkreicyxrzo6igif3yrbm3mcke76oyihu4ffvb6xvohxif6n3s2f4vx6y)
![Screenshot of YouTube showing a transcript of a phone call between Péter Szijjártó and Sergey Lavrov
0:00 — "Hello. Hello, Sergey. This is Peter speaking. Yes, Peter. Are you in St. Petersburg? Where are you? Uh, I landed in Budapest already."
0:08 — "Just already. Already? Yeah. Yeah."
0:11 — "You were on all headlines in the Russian media today. Oh, did I say something wrong?"
0:18 — "No, no, no, no, no. They were just saying that you are pragmatically fighting for the interests of your country. Oh well well that's a that's a"
0:26 — "very let's say nice uh um let's say analysis of the situation. Nice way to put it."
0:33 — "Yeah [laughter] that's absolutely and fair and fair and fair and fair. Look I I am calling on on the request of Alisa uh and he"](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:jhpu65fmdl4lm2aann5pjjyl/bafkreidja5dt2m4nh3nr556i5rpukjekqgx5bqny5sbaol37xjk2lrtmuu)
![Screenshot: The command injection is present here but it is not immediately obvious unless you are very familiar with the nuances of Bash arithmetic evaluation. To assist us, we ask Gemini. The following Gemini response explains the problem very clearly:
Yes, there is a potential command injection (or more accurately, arbitrary code execution) vulnerability in this script.
While it looks like a simple numeric comparison, the way Bash handles the [[ ... ]] construct with the -lt (less than) and -gt (greater than) operators involves Arithmetic Evaluation.
The Vulnerability: Arithmetic Evaluation
In Bash, when using arithmetic operators like -lt, -gt, or -eq inside [[ ]], the shell treats the operands as expressions. If an attacker can control the value of remoteVersion, they can pass a string that Bash will evaluate as code.
How an attacker would exploit it:
If an attacker provides a payload like:
remoteVersion='a[$(touch /tmp/pwned)]0'
When the script reaches this line:
if [[ "$localVersion" -lt "$remoteVersion" ]]; then
Bash evaluates remoteVersion. Because it sees the structure of an array index or an expression, it executes the command inside the subshell $(...) to determine the value.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:jhpu65fmdl4lm2aann5pjjyl/bafkreifjf5putberqbut6qnb75btqdy3jq3iylgdgxf7amnik6ur5i3dbi)
