CVSS 8.8 (High) | Actively Exploited in the Wild | Renderer RCE (Sandboxed)
A use-after-free vulnerability in Google Chrome's Blink CSS engine that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page.
I'm not on a vulnerable user, but I'd prefer not to run RCE's on web pages I'm browsing which aren't presented as containing the RCE, even if they are doing it to notify me of the vuln.
I have nothing against AI myself, but it significantly changed how hackathons work.
One prominent example I won't name, I had attended over a couple years. Coincidentally,the timing overlapped with pre-LLM boom and post-LLM boom.
My first edition had zero usage of LLMs, the last had practically 100%, the rules were accommodated. The teams were no longer required to present a working example, a literal figma concept and a cool slideshow were more than enough.
this reads kind of... bitter? The theme of the hackathon was AI (as noted by the author further down), so I'm not sure why he seems surprised/upset that 'All winners had "AI" as a significant part of their solution.'
The other points were always true for hackathons (For some more than others, depending on judges/audience), even before AI coding was a thing.
> I've been working on this since last September at a slow burn (no code reused for HackEurope though) and the goal is to have a running startup by May.
If anything, this is pretty much the opposite of what a hackathon is supposed to be: A place where you meet people you might not even know, come up with an idea on the spot and develop an MVP + pitch it on a tight (time) budget. Taking an idea you've already been working on for months and using it for a hackathon submission feels... odd
> A solid 90% of the projects there were just vibe coded slop. Even the ideas were AI. You can tell when multiple people implemented the exact same idea with the exact same title, description, and implementation.
The first is probably true, but to really judge the impact of it (Did AI generated ideas actually win?) we'd have to see the results
> A lot of cool ideas are out of distribution from the training data, and those rarely show up at hackathons anymore. The AI says they're "too hard" and people simply avoid these.
I say it somewhat jokingly. Most of the challenges were AI, but there was a specific security track that wasn't about AI (but AI bug bounty hunter won. Not too mad, just annoyed at miscommunication about which countries the sponsor was actually in).
> If anything, this is pretty much the opposite of what a hackathon is supposed to be: A place where you meet people you might not even know, come up with an idea on the spot and develop an MVP + pitch it on a tight (time) budget. Taking an idea you've already been working on for months and using it for a hackathon submission feels... odd
The thing I've been working on is a much larger encompassing system where this would just be a small component. No code reused because no code was written for this yet. My task now is to take the shit code written during the hackathon and make it actually usable.
> The first is probably true, but to really judge the impact of it (Did AI generated ideas actually win?) we'd have to see the results
Yes, the winner also won the Lovable and Claude tracks. Lovable track was specifically about vibe-coding.
Why does this page include this code?
https://github.com/huseyinstif/CVE-2026-2441-PoC
CVSS 8.8 (High) | Actively Exploited in the Wild | Renderer RCE (Sandboxed)
A use-after-free vulnerability in Google Chrome's Blink CSS engine that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page.
I was playing around with it a while back and forgot to remove it...
I'm not on a vulnerable user, but I'd prefer not to run RCE's on web pages I'm browsing which aren't presented as containing the RCE, even if they are doing it to notify me of the vuln.
I have nothing against AI myself, but it significantly changed how hackathons work.
One prominent example I won't name, I had attended over a couple years. Coincidentally,the timing overlapped with pre-LLM boom and post-LLM boom. My first edition had zero usage of LLMs, the last had practically 100%, the rules were accommodated. The teams were no longer required to present a working example, a literal figma concept and a cool slideshow were more than enough.
Damn, AI murdered this guy’s hackathon submission. Why would AI do that?!
this reads kind of... bitter? The theme of the hackathon was AI (as noted by the author further down), so I'm not sure why he seems surprised/upset that 'All winners had "AI" as a significant part of their solution.'
The other points were always true for hackathons (For some more than others, depending on judges/audience), even before AI coding was a thing.
> I've been working on this since last September at a slow burn (no code reused for HackEurope though) and the goal is to have a running startup by May.
If anything, this is pretty much the opposite of what a hackathon is supposed to be: A place where you meet people you might not even know, come up with an idea on the spot and develop an MVP + pitch it on a tight (time) budget. Taking an idea you've already been working on for months and using it for a hackathon submission feels... odd
> A solid 90% of the projects there were just vibe coded slop. Even the ideas were AI. You can tell when multiple people implemented the exact same idea with the exact same title, description, and implementation.
The first is probably true, but to really judge the impact of it (Did AI generated ideas actually win?) we'd have to see the results
> A lot of cool ideas are out of distribution from the training data, and those rarely show up at hackathons anymore. The AI says they're "too hard" and people simply avoid these.
Probably true, but again, not a new phenomenon.
> The theme of the hackathon was AI
I say it somewhat jokingly. Most of the challenges were AI, but there was a specific security track that wasn't about AI (but AI bug bounty hunter won. Not too mad, just annoyed at miscommunication about which countries the sponsor was actually in).
> If anything, this is pretty much the opposite of what a hackathon is supposed to be: A place where you meet people you might not even know, come up with an idea on the spot and develop an MVP + pitch it on a tight (time) budget. Taking an idea you've already been working on for months and using it for a hackathon submission feels... odd
The thing I've been working on is a much larger encompassing system where this would just be a small component. No code reused because no code was written for this yet. My task now is to take the shit code written during the hackathon and make it actually usable.
> The first is probably true, but to really judge the impact of it (Did AI generated ideas actually win?) we'd have to see the results
Yes, the winner also won the Lovable and Claude tracks. Lovable track was specifically about vibe-coding.
I am just slightly annoyed yes.