Original post on tyde.com

How One Token Could Have Compromised Every Microsoft Entra ID Tenant on Earth, And Why It’s Time for Authorityless Security

Recently, security researcher Dirk-Jan Mollema disclosed CVE-2025–55241, a vulnerability so catastrophic that it reads like fiction: a single token, obtained from any test tenant, could have granted complete administrative control over every Microsoft Entra ID (Azure AD) tenant in the world. Every. Single. One.

Let that sink in. Dirk-jan uncovered a path where a lab account was all it took to open the doors to every Microsoft cloud customer, from Fortune 500 corporations to the smallest startups.

This isn’t just another vulnerability. It’s another smoking gun that proves our entire approach to cybersecurity is fundamentally broken.

Another God Mode Vulnerability in a Long Line of “Never Should Have Happened” Breaches

The short version for non-technical readers: An attacker could have become anyone in any Microsoft cloud tenant, accessed anything, and done it all completely undetected with what appeared to be legitimate access that bypassed all security controls. Think of it as finding a master key that opens every door in every building in the world, while also making you invisible to all security cameras.

The technical details: Microsoft’s backend uses something called “Actor tokens” for service-to-service communication. Due to a critical validation flaw, these tokens could be used across tenant boundaries, granting attackers the ability to read all user data, group memberships, application permissions, even BitLocker keys, completely undetected. When ready to strike, they could create new. Global Admin accounts or take over existing identities.

The vulnerability existed because Microsoft’s architecture requires services to have god-like powers to function. They built a system where ultimate authority had to be trusted to someone, and that trust became the vulnerability.

“If We Can’t Trust Microsoft, Who Can We Trust?”

For decades, enterprises have justified their security decisions with a simple question: “If we can’t trust Microsoft, who can we trust?” It’s been the ultimate defense when things go wrong: at least you chose the industry standard.

This vulnerability, along with countless others across the industry, demolishes that logic. Microsoft joins a growing list of “trusted” vendors that suffered catastrophic breaches: Okta’s exposure of all customer support system users, Cisco’s hidden backdoor account exploited in attacks, BeyondTrust’s remote support SaaS compromise, and severe zero-trust flaws in Check Point, Zscaler, and Netskope. Each had the resources, expertise, and certifications. Each failed catastrophically. It’s inevitable.

What should really concern you is the invisibility of these flaws. Behind all the security promises and compliance badges, customers had no way of knowing these Actor tokens existed or carried such sweeping powers. You can’t audit what you can’t see, and you can’t secure what you must blindly trust.

The uncomfortable reality is that this is just the vulnerability that was discovered and disclosed responsibly. How many similar flaws are lurking in these vast codebases? How many have already been found by nation-state actors who are quietly exploiting them? When you have systems this complex, with this much centralized authority, vulnerabilities aren’t anomalies. They’re mathematical certainties.

The Ultimate Supply Chain Attack Vector

Large platforms like Microsoft aren’t just targets, they’re supply chain force multipliers. Compromise Microsoft, and you compromise everyone. This vulnerability proved that definitively.

Consider the exponential nature of the attack path discovered: starting from a single compromised tenant, an attacker could jump to every tenant that had guest users, then to every tenant those tenants had connections to. Within minutes, the majority of all Entra ID tenants worldwide could have been mapped and compromised.

Microsoft’s own tenant would likely be one of the first compromised (since Microsoft consultants are guests in countless customer tenants), and from there, every major service provider would be one step away. The entire global business infrastructure, falling like dominoes.

This isn’t a bug. It’s the natural consequence of building systems where ultimate authority must be blindly trusted to the system, and those that administer it.

Why “Authority” Is the Real Vulnerability

First, let’s define what we mean by “authority” in the digital world: it’s the power to grant access, approve actions, or enforce rules within a system. It’s what lets someone or something open the door to sensitive data, change configurations, or allow operations to run. Think of it as the master key to your digital kingdom.

The root cause of this Microsoft vulnerability wasn’t poor coding or lack of testing. It also isn’t correct to say that it’s the need to trust Microsoft. It’s more accurately what we’re trusting Microsoft with — Authority.

As long as someone or something holds it, it can be exploited. Today’s systems are built with someone, somewhere, having the ability to do anything. Maybe it’s an administrator, maybe it’s the vendor, maybe it’s a service account, maybe it’s a sub-system, but that ultimate power exists. And it doesn’t need to. Modern cryptographic techniques have made it possible to build systems where no single entity needs or has complete authority, where authority itself is distributed across multiple independent parties who must collaborate to act.

Traditional security, even “Zero Trust” security, doesn’t eliminate authority. It just moves it around. You stop trusting the network perimeter, but now you must blindly trust your Identity Provider. You implement defense in depth, but at the bottom of that depth sits an all-powerful system that, if compromised, renders every other defense meaningless.

The Actor token vulnerability perfectly illustrates this. It doesn’t matter how many security policies you had, how much you spent on monitoring, or how well-trained your security team was. When the Identity Provider itself is compromised at the most fundamental level, all of that becomes theater.

The Path to Authorityless Security

We need systems where inevitable breaches don’t have catastrophic consequences. We need architectures where authority doesn’t exist in any single place that can be compromised.

Imagine a world where:

• No single entity, not even the platform vendor, can access your sensitive data
• No administrator, no matter how privileged, can override the system without oversight
• No supply chain compromise can grant universal access
• No vulnerability, no matter how critical, can provide god-mode to attackers

This isn’t just better for security, it’s for a better ecosystem. Platform vendors can demonstrate they’re beyond reproach. Businesses can verify their security rather than hope for it. Users can trust systems because they don’t have to. Mistakes will be made, breaches will continue, but platforms will be cyber-immune to the consequences.

The technology to eliminate centralized authority already exists. Forward-thinking vendors are adopting it because they recognize the core architectural flaw, don’t want the liability, want to build fast and innovate without losing sleep over breaches, want to simplify compliance, and want customers to trust them because they no longer have to.

Consider how this alternative approach works: authority over user identities, administrative actions, and business data is distributed in the form a key who’s pieces live across a decentralized network. No single node, organization, or administrator ever holds complete power. When someone needs access to data:

1. Their identity is verified through distributed authentication where no single node knows their credentials
2. Authorization requires cryptographic consensus from multiple independent servers
3. Cryptographic keys needed to decrypt data or sign access tokens never exist in any one place, only their cryptographic actions manifest through the collaboration of multiple independent nodes
4. Even if an attacker compromises the IAM or multiple nodes holding key fragments, they cannot forge access or decrypt data

The crucial difference: there is no Actor token. There is no god mode. There is no single point of authority that, if compromised, hands over the kingdom.

In such a distributed system, the keys that could elevate privileges or forge tokens remain out of anyone’s reach. So even with a vulnerability similar to Microsoft’s, attackers still couldn’t access customer data, impersonate users, or grant themselves permissions. Mathematical guarantees ensure that authority remains distributed, even in the face of compromise.

The Uncomfortable Questions We Must Ask

Next week, another critical vulnerability will be discovered. Another emergency patch will be rushed out. Another post-mortem will be written. But the fundamental problem will remain: we’re trusting single entities with absolute authority over our most critical systems.

Consider the numbers: despite over $300 billion spent on cybersecurity annually, breaches caused over $10 trillion in damage last year. Things are only getting worse. This isn’t a failure of execution, it’s a failure of architecture.

How many undiscovered Actor token-equivalent vulnerabilities exist right now? How many have been found by adversaries who are silently exploiting them? How long can we pretend that “trust Microsoft” or “trust Google” or “trust any single vendor” is an acceptable security strategy?

The answer is clear: we can’t. Not anymore.

The Future Is Authorityless

The Actor token vulnerability isn’t just another security incident. It’s more proof that our entire approach to security is fundamentally flawed. As long as ultimate authority exists in any single place, that place will be compromised.

The future belongs to systems where authority doesn’t exist in any single place. Where cryptographic proofs replace blind trust. Where mathematical guarantees supersede vendor promises. Where the inevitable breach doesn’t mean inevitable catastrophe.

This isn’t about replacing one vendor with another. It’s about eliminating the need for vendors to hold any authority at all, replacing it with distributed, verifiable, mathematically-guaranteed security.

Microsoft has fixed this particular vulnerability. But the architecture that made it possible, the existence of centralized, god-like authority, remains. And it will remain until we collectively decide that trusting any single entity with everything is no longer acceptable.

The question isn’t whether another Actor token-level vulnerability exists. It’s when it will be discovered, and by whom.

Isn’t it time we stopped gambling with that question?

Let’s talk about the one tech channel that’s actually changing the world while teaching you microsoldering:

LOUIS ROSSMANN (@rossmanngroup) – THE PEOPLE’S TECH WARRIOR
This YouTuber simultaneously running a successful repair business while leading a consumer rights movement

Board repair streams (real-time problem solving)

Right-to-repair legislative updates

Brutal takedowns of anti-consumer tech practices

Signature Rossmann-isms:

“This is why we can’t have nice things”

“The free market will sort it out” (said while rolling eyes)

That one laugh he does when Apple does something predictably awful

To find out more about this topic you can find more info on Louis Linktree

While you’re watching Rossmann, don’t miss these other tech truth-tellers:

Explaining Computers: The Most Trusted Voice in Tech Education (Christopher Barnatt)

If you want clear, hype-free tech insights without the usual YouTube sensationalism, Christopher Barnatt’s Explaining Computers is the channel you’ve been searching for.
Why This Channel Stands Out:

No Fluff, No Drama – Just deeply researched, well-structured tech explanations
Future-Focused – Covers emerging tech before it’s trending (quantum computing, SBCs, AI ethics)
The Perfect Balance – Technical enough for enthusiasts, accessible enough for beginners
Must-Watch Series:

"Future of Computing" (Annual updates on next-gen tech)
Raspberry Pi Deep Dives (Projects beyond the basics)
"Explaining the Future" (AI, blockchain, and paradigm shifts)

Who It’s For:

• Learners who hate clickbait
• Developers exploring SBCs (RPi, Pico, etc.)
• Anyone who wants to understand tech, not just use it

Fun Fact: Barnatt is a former university lecturer – and it shows in his methodical approach.

What’s your favorite Explaining Computers video? Mine’s his Post-Quantum Cryptography breakdown.

NetworkChuck: The Most Electrifying Tech Educator on YouTube (And Why You Should Watch)

If you think networking and cybersecurity sound boring, NetworkChuck will change your mind in 30 seconds flat. This is tech education with the energy of a double espresso shot!
Why He Stands Out:

Charisma Overload: Makes subnetting as exciting as a Marvel movie
Hands-On Labs: From hacking his own coffee maker to building a $100 homelab
"You Can Do IT!" Philosophy: Breaks down imposter syndrome while teaching Linux cli

Must-Watch Series:

"you suck at Linux" (The tough love Linux tutorial we all needed)
Hacking Challenges (Ethical hacking with actual hacksplaining)
Homelab Evolution (Watch his lab grow from Raspberry Pis to a full rack)

Best For:

IT newbies who need motivation
Career-changers entering tech
Anyone who learns better with memes than textbooks

David Bombal: The Dark Horse of Tech Education (Why He Belongs in Your Watchlist)

While others entertain, Bombal forges engineers. Here’s why this Cisco whisperer deserves your attention:

The Bombal Difference:

CCNP-Level Tutorials for Free: Teaches enterprise networking like you're shadowing a senior engineer
Packet Tracer Sorcery: Makes complex protocols visceral with live CLI demonstrations
No Hype, All Substance: 2-hour deep dives where other creators would make 10 clickbait videos

Hidden-Gem Content:
▸ “GNS3 vs EVE-NG” wars (The emulator showdown we needed)
▸ Python for Network Engineers (Actual usable scripts, not just print(“Hello World”))
▸ Wireshark Forensic Challenges (Where your “Aha!” moments turn into job skills)

Who It’s For:

Network engineers tired of surface-level content
Career-changers needing enterprise-grade skills
Anyone who thinks "show interface" counts as a personality trait

Pro Move: Watch his live network troubleshooting streams to see how a CCIE approaches problems in real time.

Bombal vs The Algorithm:
While others chase views, he’s busy:

• Interviewing Vint Cerf, the “Father of the Internet” about IPv6
• Debunking network marketing scams with RFC receipts
• Building full SD-WAN labs most schools wouldn’t teach

This post is inspired by SKG (Stop Killing Games petition) but not limited to particular industry, activity or location! If you would like to find more about it & sign it up you can do so HERE.

“You’ll own nothing and be happy” is a phrase published by the World Economic Forum (WEF). The phrase is based on a 2016 essay by Ida Auken (Socialist from Denmark) of Denmark, published by the WEF, about a future in which a hypothetical person relies on the sharing economy for many of their needs.

This dystopian vision normalizes dispossession under the guise of convenience—replacing ownership with perpetual rentals, subscriptions, and corporate control. True autonomy requires property rights; happiness shouldn’t depend on having nothing to call your own.

Proposed by modern day socialist, mega corporations and goverments, lack of ownership is not liberation —it’s surrender. No ownership means no control: over your possessions, your data, or your life. When everything is rented, permission-based, or AI-managed, freedom becomes a subscription service. In the modern era, when we should be able to have freedom of choice, ownership is the foundation of self-determination. Without ownership we lose freedom to modify, repair, or reject what’s imposed on you. Happiness without autonomy is just compliance with a smile.

REFUSE! RESIST! RECLAIM!

Utopia of convenience — no maintenance, no clutter, just seamless access to goods and services. But peel back the glossy futurism, and you’ll find a darker truth: a world where ownership disappears is a world where power concentrates.

The Illusion of Liberation

Proponents argue that ownership is a burden: why own a car when you can Uber, a house when you can Airbnb, or music when you can stream? But this isn’t freedom—it’s feudalism with a digital veneer. When you rent everything, your autonomy rents too. You can’t modify, repair, or refuse upgrades. Your access depends on algorithms, corporate policies, and the whims of landlords—both physical and digital.
The Endgame: Monopoly by Default

If individuals own nothing, someone else owns everything. Imagine:

Housing: A handful of institutional landlords dictate your lease terms.
Transportation: Ride-share surges and self-driving tolls replace car ownership.
Data: Your digital life is licensed back to you via subscriptions.

This isn’t speculation—it’s already happening. Private equity buys up homes. Tech giants lock creativity behind paywalls. Even farmers can’t repair tractors they “license.” The goal? A perpetual revenue stream from a society of permanent renters.

The Alternative: Ownership as Resistance

True freedom requires property—not just possessions, but control over your life. History’s greatest emancipations—from land reform to digital open-source movements—were about distributing ownership, not abolishing it.

The choice isn’t between clutter and convenience. It’s between a society of sovereign individuals and a world where a few oligarchs own the infrastructure of existence. If we don’t fight to own, we’ll end up owned.

Governments and economists often frame property taxes as a fair and necessary way to fund public services. But beneath the surface, property taxes function as a perpetual rent paid to the state—undermining true ownership and eroding personal freedom.

The Myth of True Ownership

When you buy a house or land, you’re told it’s yours. But if you stop paying property taxes, the government can seize it. This means you never truly own your property—you merely rent it from the state. Unlike a mortgage, which you eventually pay off, property taxes are forever. Miss enough payments, and you’ll face liens, fines, and ultimately, eviction.

This system turns the foundational right of property — a cornerstone of liberty — into a conditional privilege.

Taxation as a Tool of Control

Property taxes don’t just fund roads and schools—they enforce dependence. Governments can:

• Increase rates at will, pricing people out of their homes (see: gentrification).
• Dictate land use through tax incentives or penalties (e.g., punishing undeveloped land).
• Displace communities when rising assessments make ownership unsustainable.

In effect, you don’t control your property — the state does. It decides how much you must pay to keep it, how you should use it, and whether you’re allowed to stay.

The Freedom Alternative

Real ownership means no perpetual financial obligation to the state. Alternatives exist:

• Abolish or cap property taxes, replacing them with voluntary or consumption-based models.
• Expand homestead exemptions to protect primary residences.
• Decentralize governance so communities, not distant bureaucrats, set tax policies.

Conclusion: Reclaiming Actual Ownership

If you must pay forever to keep your property, you don’t own it—you’re leasing it from the government. True freedom requires absolute ownership, where your home, land, and assets can’t be taken over a tax bill.

The choice is clear: Either we restore real property rights, or we accept that we’re just tenants on our own land.

by ko3moc, 01/07/2025

Not all treasure is silver and gold. – Jack Sparrow

In the digital age, the line between buying and licensing has blurred. Consumers often believe they own the media they purchase—whether it’s an e-book, a movie, or a video game—only to discover they’ve merely bought a license to access it. If corporations can redefine ownership, then why can’t consumers redefine piracy?

The Illusion of Ownership

When you “buy” a digital product, you’re often just paying for conditional access. Companies can revoke licenses (like Amazon deleting purchased e-books), lock content behind DRM, or shut down services, rendering your purchases useless. If you don’t truly own what you paid for, then piracy isn’t theft—it’s reclamation.
In the age of Netflix, Spotify, and cloud-based gaming, ownership is becoming obsolete. Why buy a movie, album, or game when you can stream it instantly? But convenience comes at a cost—we’re trading true ownership for temporary access, and in the process, we’re losing real value.
You Don’t Own Anything
When you buy a DVD, a vinyl record, or a physical game, it’s yours forever. But streaming services can remove content at any time—movies disappear from libraries, songs get delisted, and games are taken offline. You’re not a collector; you’re a renter.
The Illusion of Choice
Streaming platforms control what you see. Algorithms push certain content while burying others, and licensing deals dictate what stays or goes. When you owned media, you curated your own collection. Now, corporations curate it for you.
Higher Long-Term Costs
A $15 monthly subscription seems cheap—until you realize you’ve spent hundreds over the years with nothing to show for it. Buying a movie once might cost more upfront, but you keep it forever. With streaming, you pay forever and own nothing.
Lost Cultural Artifacts
Physical media preserves culture. Books go out of print, films are edited or censored, and music gets pulled for licensing disputes. If we rely solely on streaming, future generations may lose access to art that corporations decide isn’t profitable.

Piracy as a Response to Broken Systems

If corporations treat purchases as temporary rentals, why should consumers respect artificial scarcity? Piracy thrives when access is restricted, prices are inflated, or content is region-locked. Many pirates aren’t thieves—they’re frustrated customers denied real ownership.

Not only software

Nintendo is infamous for its aggressive—some would say ruthless—crackdown on piracy and copyright infringement. From lawsuits against ROM sites to hacking lawsuits that bankrupt individuals, the company has earned a reputation for defending its IP with an iron fist.

A History of Legal Battles

• In the 2000s, Nintendo sued emulator sites like LoveROMs and EmuParadise, forcing them to remove thousands of games.
• They targeted modders and hackers, even going after people selling modified consoles.
• In 2018, a court ordered a ROM site owner to pay Nintendo $12 million in damages—a clear warning to pirates.

Modern Enforcement

Nintendo still actively DMCA’s fan projects, mods, and even YouTube videos featuring ripped game music. Their stance is simple: zero tolerance. While critics argue this hurts preservation and fair use, Nintendo insists piracy threatens their business.

The Result?

Nintendo’s strict policies have reduced large-scale piracy of their games, but they’ve also fueled resentment among fans who believe the company is too controlling. One thing’s certain: if you pirate Nintendo games, expect consequences.

Right to Repair vs. Software Piracy

As the Right to Repair movement gains momentum, it highlights a growing tension between corporate control and consumer freedom. Many manufacturers use software locks, DRM, and proprietary tools to prevent users from fixing their own devices—effectively forcing them into authorized (and often expensive) repair channels.

When Piracy Becomes a Workaround

Some users resort to cracked software, hacked firmware, or unauthorized tools to bypass these restrictions and regain control over their devices. While corporations label this as piracy, many see it as self-defense against artificial repair barriers.

The Ethical Dilemma

• Corporations argue that circumventing software locks is theft, risking security and profits.
• Advocates counter that if companies refuse to provide repair access, users have a moral right to find alternatives—even if that means “pirating” their own devices.

The Future of Ownership

As right-to-repair laws slowly progress, the line between piracy and liberation remains blurred. Should consumers have the freedom to modify what they own—even if it means breaking digital locks? The debate isn’t just about legality—it’s about who truly controls our devices.

A Sticker Worth Sticking

The phrase “When Purchasing Isn’t Ownership, Piracy Isn’t Theft” isn’t an endorsement of piracy—it’s a critique of an industry that prioritizes control over consumer rights. If companies won’t sell us real ownership, why should we play by their rules?

What is Blink by Sam Dutton

One of the web’s special powers is its composability. Web pages include a variety of different resources, potentially from multiple origins.

Blink serves as the rendering engine for Chromium-based browsers, (Chrome, Android WebView, Microsoft Edge, Opera, and Brave)

A rendering engine that transforms HTML, CSS and JavaScript code—along with images and other resources —into web pages you can view and interact with.

Blink begins the rendering process by gathering all necessary resources such as HTML, CSS, JavaScript, videos, and images. To retrieve these resources, Blink manages interactions with the network stack, in Chromium and the underlying operating system.

As soon as CSS and HTML is loaded, Blink transform that code, in the form of text, into a representation it can work with—that’s called parsing. JavaScript also needs to be parsed and then executed.

Once all that’s done, Blink can then begin the work of laying out and displaying web pages that you can view and interact with. This is rendering.

The following diagram shows the stages in the pipeline of rendering tasks, including the components, processes, and resources involved in each. Blink has a lot of work to do!
Blink rendering pipeline, with arrows that indicate progress through stages.

Render Graphics

Blink uses the open-source Skia graphics engine to interact with the underlying graphics hardware of a computer or a mobile device.

Skia provides common APIs that work across a variety of hardware and software platforms. It serves as the graphics engine for Google Chrome and many other products.

Instead of trying to support different operating systems and devices, while keeping up with platform changes, Skia uses graphics libraries including OpenGL, Vulkan, and DirectX. The library Skia uses depends on the platform it’s running on, such as Android on mobile or Windows on desktop.
Parse and execute JavaScript

To parse and execute JavaScript and WebAssembly code, Blink uses V8, an open-source engine developed by the Chromium projects.

V8 makes it possible for a developer to use JavaScript or WebAssembly code to access the capabilities of the underlying browser. For example: to manipulate the Document Object Model, which is the internal representation of a document that Blink builds from HTML code.

V8 processes JavaScript in accordance with the JavaScript standard, known as ECMAScript.
Rendering to standards

V8 processes JavaScript in accordance with the JavaScript standard, known as ECMAScript. Rendering engines like Blink are designed to interoperably implement web standards. Web standards allow developers and end-users to be confident that web pages work well, no matter what browser they’re using.

Blink follows the specifications for browser and language features defined in web standards including HTML, CSS and DOM.

HTML and the DOM

The HTML Standard defines how browser engineers should implement HTML elements. The specification for each HTML element includes a section that defines the DOM interface for the element. This details how JavaScript should be implemented by the browser, to allow interaction with the element in a way that’s standardized across devices and platforms.

The interface specification is written in WebIDL: Web Interface Definition Language. The following WebIDL is part of the HTML standard’s definition of the HTMLImageElement.

[Exposed=Window, LegacyFactoryFunction=Image(optional unsigned long width, optional unsigned long height)] interface HTMLImageElement : HTMLElement { [HTMLConstructor] constructor(); [CEReactions] attribute DOMString alt; [CEReactions] attribute USVString src; [CEReactions] attribute USVString srcset; [CEReactions] attribute DOMString sizes; [CEReactions] attribute DOMString? crossOrigin; [CEReactions] attribute DOMString useMap; [CEReactions] attribute boolean isMap; [CEReactions] attribute unsigned long width; [CEReactions] attribute unsigned long height; readonly attribute unsigned long naturalWidth; readonly attribute unsigned long naturalHeight; readonly attribute boolean complete; readonly attribute USVString currentSrc; [CEReactions] attribute DOMString referrerPolicy; [CEReactions] attribute DOMString decoding; [CEReactions] attribute DOMString loading; [CEReactions] attribute DOMString fetchPriority; Promise<undefined> decode(); // also has obsolete members };

To implement a feature, engineers put that WebIDL code in a file, and this automatically gets transformed by Blink to provide an interface to developers for that feature. Once the interface is defined with WebIDL, engineers can build the implementations that respond to interface calls.

Third-party libraries

Blink uses multiple third-party libraries. For example, WebGL is used to render interactive 2D and 3D graphics.
Third-party libraries in Chromium source—including WebGL used by Blink.

Libraries such as WebGL are highly optimized and carefully tested. They give Blink access to important features and functionality, without needing to reinvent the wheel. The WebGL IDL is defined, and the Blink engineers connect that web interface with code and libraries on the backend that are used to render many different elements .

If you want to see WebGL in action, check out the fractal rendering app Fractious, which uses WebGL.
Fractious: a WebGL-based viewer for the Mandelbrot Set.
Cross-platform rendering

You might be wondering, does Chrome use Blink everywhere, on all operating systems and devices?

On iOS and iPadOS, Chrome uses WebKit as its rendering engine. WebKit was actually a fork of another project, KDE, which goes all the way back to 1998. In fact, Safari and Chromium were both initially based on WebKit. Today, Safari and all browsers in the Apple ecosystem use WebKit, according to Apple’s App Store requirements.

Over time, the Chromium projects developed a different multi-process software architecture, as maintaining two separate architectures in one codebase was becoming problematic.

In addition, Chromium wanted to use features that weren’t being built into WebKit. So, starting from version 28, Chromium engineers decided to begin work on their own rendering engine. They forked their code from WebKit, and they called it Blink. Rumor has it that Blink was named after the (not so) beloved tag that was available in the Netscape Navigator browser to make text blink on and off.

To sum up: Chrome, Microsoft Edge, Opera, Vivaldi, Arc, Brave, and other Chromium-based browsers and frameworks use Blink. Safari and some other browsers use WebKit, along with all browsers on iOS and iPadOS including Chrome. Firefox uses a rendering engine called Gecko.

Blink is not a vulnerability—it’s a core component that handles HTML, CSS, and JavaScript rendering.

However, like any complex software component, Blink can contain vulnerabilities if security flaws are discovered in its code. Google and the Chromium team regularly patch such issues through updates. Some examples of past Blink-related vulnerabilities include:

1. Use-after-free bugs (memory corruption issues that could lead to remote code execution).
2. Type confusion flaws (misinterpretation of object types leading to exploits).
3. Rendering bugs (such as CSS or SVG parsing issues that could bypass security restrictions).

Is Blink a Security Risk?

• Blink is heavily sandboxed in Chrome, meaning even if an exploit exists, it’s harder to break out of the browser’s security layers.
• Google’s bug bounty program rewards researchers who report Blink vulnerabilities, helping keep it secure.
• Zero-day vulnerabilities in Blink can be dangerous, but they are rare and quickly patched.