I finally understand why some good guys quit the Android bug bounty program.
Thomas King
- 117 Followers
- 21 Following
- 21 Posts
Android/Browser Vulnerability Research, Reverse Engineering.
Jann HornI found a Linux kernel security bug (in AF_UNIX) and decided to write a kernel exploit for it that can go straight from "attacker can run arbitrary native code in a seccomp-sandboxed Chrome renderer" to kernel compromise:
https://googleprojectzero.blogspot.com/2025/08/from-chrome-renderer-code-exec-to-kernel.html
This post includes fun things like:
- a nice semi-arbitrary read primitive combined with an annoying write primitive
- slowing down usercopy without FUSE or userfaultfd
CONFIG_RANDOMIZE_KSTACK_OFFSETas an exploitation aid- a rarely-used kernel feature that Chrome doesn't need but is reachable in the Chrome sandbox
sched_getcpu()usable inside Chrome renderers despitegetcpubeing blocked by seccomp (thanks to vDSO)
Terence EdenI've found that replying to unsolicited messages with "ζηͺη?" is a remarkably effective way of flushing out scammers π
Ivan FratricA nice dav1d AV1 decoder integer overflow found by @x43r0 https://bugs.chromium.org/p/project-zero/issues/detail?id=2502
Ben Hawkes"The WebP 0day" -- a full technical analysis the recently patched vulnerability in the WebP image library that was exploited in the wild (CVE-2023-4863).
https://blog.isosceles.com/the-webp-0day/
We suspect that this is the same bug that Citizen Lab reported to Apple after detecting an NSO Group exploit chain called "BLASTPASS" that was used to attack on a Washington DC-based civil society organization.
Many thanks to mistymntncop who made several key technical contributions to this analysis.
The WebP 0day
Early last week, Google released a new stable update for Chrome. The update included a single security fix that was reported by Apple's Security Engineering and Architecture (SEAR) team. The issue, CVE-2023-4863, was a heap buffer overflow in the WebP image library, and it had a familiar warning attached: "Google
Due to lack of visa, I canβt attend BlackHat USA 2023. I hope pre-recording brings you enjoyment.
James Forshaw 
Some fun issues in the Samsung Exynos baseband. https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html
Proteas`bindiff-tool` is an assistant for `BinDiff`, with this tool, you can use `js` to program `BinDiff` results partially: https://github.com/Proteas/bindiff-tool
Seth Jenkins (@jenkins) wrote a blog post on a new kernel exploitation technique for exploiting a temporary-increment-at-controlled-address bug without an infoleak: https://googleprojectzero.blogspot.com/2022/12/exploiting-CVE-2022-42703-bringing-back-the-stack-attack.html
