The recording of itszn's and my offensivecon talk "Attacking JavaScript Engines in 2022" is now on YouTube: youtu.be/FK2-1FAbbXA

Google CTF 2022 d8: From V8 Bytecode to Code Execution: mem2019.github.io/jekyll/update/…

New V8 Sandbox design document on how to sandboxify pointers to objects outside the sandbox such as DOM nodes ("external pointers"): docs.google.com/document/d/1V3…

I had a great time in Chungbuk Hacking Camp as a member of a Demon team of POC. I gave a lecture about the system hacking 101 and wrote a pwnable question for the CTF held in there. By meeting all the students who have passion in the hacking, I was able to gain my passion again.

I've released a beta version of #pawnyable, a website to learn advanced binary exploitation🐺🐱🐰🐼 Currently only the Linux Kernel chapter is about 90% complete😖 Other chapters and multilingual support are TODO😇 pawnyable.cafe

늦었지만 Defcon Qauls 2023 느낀점과 writeups :p (open-house, test-your-luck) jiravvit.github.io/230531-defcon2…

A carefully structured, tiered root cause analysis for CVE-2025-43529 (JSC UAF). Spent quite some time refining the structure to make the reasoning explicit and readable. Shoutout to jir4vv1t for his detailed analysis and exploit. github.com/bjrjk/CVE-2025…

I work for Google Threat Intelligence Group. My job is to identify threats to Google's AI models. I am very good at my job. I published a report this month about "distillation attacks" — when outside actors query our models thousands of times to extract the underlying logic and