Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641

Remote iPhone Exploitation 2: Bringing Light into the Darkness

Bad Binder: Android In-the-Wild Exploit

Windows Exploitation Tricks: Spoofing Named Pipe Client PID

KTRW: The Journey to Build a Debuggable iPhone

The Fully Remote Attack Surface of the iPhone

iMessage bug allowed any file to be read remotely

Down the Rabbit Hole

Down the Rabbit-Hole

Project Zero Vulnerability Disclosure FAQ

A deep dive into iOS Exploit chains found in the wild

Windows Exploitation Tricks: Abusing the User-Mode Debugger

Project Zero: The Definitive Guide on Win32 to NT Path Conversion (2016)

Virtually Unlimited Memory: Escaping the Chrome Sandbox

Exploit for iOS 12.0 on iPhone Xs – Google Project Zero

Windows Kernel Logic Bug Class: Access Mode Mismatch in IO Manager

Examining Pointer Authentication on the iPhone XS

Examining Pointer Authentication on the iPhone XS

The Curious Case of Convexity Confusion

Voucher_swap: Exploiting MIG reference counting in iOS 12

Taking a page from the kernel's book: A TLB issue in mremap()

Adventures in Video Conferencing Part 1: The Wild World of WebRTC

On VBScript

Searching statically-linked vulnerable library functions in executable code

Heap Feng Shader: Exploiting SwiftShader in Chrome

Finding and Exploiting Safari Bugs Using Publicly Available Tools

A cache invalidation bug in Linux memory management

Adventures in vulnerability reporting

More Mac OS X and iPhone sandbox escapes and kernel bugs

Reading privileged memory with a side-channel

More →