1. Telemetry as implemented is usually sloppy. Even though intuitively one could think that telemetry means “data gets collected locally and fired off to a remote server”, we have seen time and time again that they also build a return path to make the telemetry gathering more powerful. That return path can be a vector.
2. Web browsers have a _huge_ surface and they connect to remote servers constantly. The industry does very well at being proactive and at addressing CVEs but the whole premise makes that very difficult and so we cannot absolutely claim that browsers don’t have RCE(s).
What return path could possibly lead to a RCE? That's crazy, no telemetry requires "backend could return any command that gets run on the client", you're doing telemetry in a very non-standard way if this is even possible.
At worst, the telemetry backend might first send the client a config, but none of that would contain executable commands because again, that'd be crazy.
> we cannot absolutely claim that browsers don’t have RCE(s).
Of course, you can never prove the absence of bugs (and/or security issues), but given that browsers aren't wildly exploited at this very moment, nor have been for quite some time, we can pretty confidently claim there are no browser RCEs in wide use today.
It's true that browsers have pretty big attack surface, but it's also true that it's the class of software that gets the more pentesting, since the payoff would be so great when you manage to find holes.
API protocol says “return value is either “OK” or “ERR””, attacker sends “Floccinaucinihilipilification”, overflowing the 3-byte response buffer allocated on the stack.
I'm claiming if "everything else" does indeed lead to a RCE, you're again doing something very wrong here. It's not rocket science exactly.
I'd go out on a limb here perhaps, but I'd claim that if your telemetry means that the one SENDING the data gets a RCE by default by it, you're doing telemetry very wrong. Maybe look into different libraries/services than the ones you use today, please.
To stack assumptions, I'd reach for something like using the recent certificate circus to present as there being an updated version of whatever model it uses on the PCs that can run it locally to give it a fucked up model that does the out of bounds shit as part of whatever verification/checks it does after its downloaded/installed.
It's quite common with vulnerabilities found by IA, there might be less hallucination, but the impact/score is often completely wrong.