List of Chromium security bugs (with technical details) that received top bounty rewards from Google VRP: bugs.chromium.org/p/chromium/iss… Congrats to bug finders!

Chromium [WIP] internal fuzzing map by source code directory, official dashboard analysis.chromium.org/coverage/p/chr…

Research insights on recent Chrome 0day in Skia (CVE-2023-6435) from our lab: 1. The bug is an integer overflow in Skia, an open source library for rendering 2D graphics which which is used in Chromium backend. 2. The bug can be used to escape browser sandbox in Chrome app on

Tracking bug for v8 the_hole bug class mitigations bugs.chromium.org/p/chromium/iss…

0-Day Insights - Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023 zerodayengineering.com/insights/qualc… (by Alisa Esage Шевченко)

(CVE-2024-3914)[330759272][Pwn2Own 2024][DOMArrayBuffer]DOMArrayBuffer confused about ownership of backing buffer -> UAF is now open with PoC and exploit issues.chromium.org/issues/3307592… PoC: issues.chromium.org/action/issues/… Exploit: issues.chromium.org/action/issues/… WP: issues.chromium.org/action/issues/… Xion

Short and to the point, patch analysis + PoC of Windows Kernel ntoskrnl LPE bug (CVE-2024-38106), by S K: pixiepointsecurity.com/blog/nday-cve-… This bug is being exploited in-the-wild, as part of a browser exploit chain with Chrome v8 RCE (CVE-2024-7971), reported in August 2024

Slides: "Fuzzing from First Principles": zerodayengineering.com/research/slide… I heard that the podcast reached all-time-highest number of viewers, thank you for coming to see me!

Analysis of VMware vCenter heap overflow vulnerability exploited at Matrix Cup competitions in China, June 2024 (CVE-2024-38812): blog.sonicwall.com/en-us/2024/10/… Another one in same code, 2023: blog.sonicwall.com/en-us/2023/12/… ** Both are RCE to management console, not a hypervisor VM escape!