Saint Magellan 2.0, Who Circumnavigated the Database

Patron of SQLite inside the browser, the old WebSQL, and everyone who didn't know a web page could query a local database.

Life

On 11 December 2019 the Tencent Blade Team published Magellan 2.0, five flaws in SQLite exploitable from Chrome through the old WebSQL API, enabled by default. A malicious page could send SQL queries and, with an out-of-bounds write, corrupt the heap all the way to code execution. A sequel to the first Magellan the year before, from the same crew; Google fixed it all in Chrome 79.

Prayer

O Saint Magellan 2.0, who sails other people's tables starting from a web page, let our browsers open no databases to strangers. Amen.

How to celebrate

Celebrated by updating Chrome to 79 and gladly waving goodbye to WebSQL's retirement.

Hand the database helm to the browser and you'll end up off course.