Fuzzing ImageIO

You Won't Believe What This One Line Change Did to the Chrome Sandbox

What a one line change did to the Chrome sandbox

Mitigations are attack surface, too

Escaping the Chrome Sandbox with RIDL

Several months in the life of Project Zero – Part 1: The Chrome bug of suffering

Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641

Remote iPhone Exploitation 2: Bringing Light into the Darkness

Bad Binder: Android In-the-Wild Exploit

Windows Exploitation Tricks: Spoofing Named Pipe Client PID

KTRW: The Journey to Build a Debuggable iPhone

The Fully Remote Attack Surface of the iPhone

iMessage bug allowed any file to be read remotely

Down the Rabbit Hole

Down the Rabbit-Hole

Project Zero Vulnerability Disclosure FAQ

A deep dive into iOS Exploit chains found in the wild

Windows Exploitation Tricks: Abusing the User-Mode Debugger

Project Zero: The Definitive Guide on Win32 to NT Path Conversion (2016)

Virtually Unlimited Memory: Escaping the Chrome Sandbox

Exploit for iOS 12.0 on iPhone Xs – Google Project Zero

Windows Kernel Logic Bug Class: Access Mode Mismatch in IO Manager

Examining Pointer Authentication on the iPhone XS

Examining Pointer Authentication on the iPhone XS

The Curious Case of Convexity Confusion

Voucher_swap: Exploiting MIG reference counting in iOS 12

Taking a page from the kernel's book: A TLB issue in mremap()

Adventures in Video Conferencing Part 1: The Wild World of WebRTC

On VBScript

Searching statically-linked vulnerable library functions in executable code

More →