In the end it all boiled down to old-style plugins. All the exploits were used to finally install and run an old-style NPAPI plugin.
Just like ActiveX, these are binary code that usually runs outsidE of any sandboxing due to compatibility reasons.
With NaCL or just the advances in HTML and related technologies, this kind of plugin really should have outlived its usefulness by now and maybe it's time to drop support - at least support for all plugins but a few whitelisted ones from the older ages.
Like Flash and maybe QuickTime (though both have a terrible security track record).
Though considering the persistence of piling up bugs that was happening here, for all we know, there would have been a different exploit somewhere else that could have worked even without NPAPI. It would just close one more attack surface.
Wait until you see the other one. There are a surprising and depressing number of ways to get a browser to run native code on legacy operating systems.
Yes, plugins should go away. No, that won't stop this kind of thing :/.
Let's be fair here, This particular bug used an NPAPI installation to finally get full access, but there many other significant breaches of security previous to this, it seems that the final step, was likely one with the most potential vulnerabilities, with NPAPI just being the easiest to install the payload.
Just like ActiveX, these are binary code that usually runs outsidE of any sandboxing due to compatibility reasons.
With NaCL or just the advances in HTML and related technologies, this kind of plugin really should have outlived its usefulness by now and maybe it's time to drop support - at least support for all plugins but a few whitelisted ones from the older ages.
Like Flash and maybe QuickTime (though both have a terrible security track record).
Though considering the persistence of piling up bugs that was happening here, for all we know, there would have been a different exploit somewhere else that could have worked even without NPAPI. It would just close one more attack surface.