CTF/pwn writeups and V8 exploitation notes.

A technical writeup on a 0day vulnerability I reported inside V8, Chrome's JS engine

Authored by stratan In Part 1, we went over the background details that are needed to follow along, as well as the trigger specifics of the bug. In Part 2, we'll go through the relevant code paths, analyze the patch, and develop an in-cage read/write primitive. Disclaimer This article has been prepared for

Publications from Calif. Contribute to califio/publications development by creating an account on GitHub.

Beneath the surface, the modern web is made possible only through a growing labryinth of technology standards. Standards are designed to govern the interoper...

Kaspersky researchers discovered previously unidentified commercial Dante spyware developed by Memento Labs (formerly Hacking Team) and linked it to the ForumTroll APT attacks.

Minimal code to connect to a CEF debugger

Found a security vulnerability? Discover our forms for reporting security issues to Google: for the standard VRP, Google Play, and Play Data Abuse.

Technical breakdown of a Remote Code Execution vulnerability in Google Web Designer via a malicious Video Ad Template abusing the NinjaShell API.

Chrome V8 Type Confusion Zero-Day: CVE-2025-10585 - Detailed Code Analysis and Visual Examination

Fixed in version 16.4.0.0711 — $3,500 bug bounty

Mutation-Based XSS + V8 type confusion + V8 sandbox escape = RCE on Basecamp. Disclosed it on Hackerone: https://t.co/slsv3j4jXx go read the comments if you wanna see what a week of exploit dev pain looks like.

In this post I'll look at some use-after-free vulnerabilities in Chrome which were the result of object lifetime misassumptions based on objects being kept alive unexpectedly in audio callbacks.

The unusual technique invokes the Windows App Installer to deliver malware

This post is a technical analysis of a recently disclosed Chrome JIT vulnerability (CVE-2021-30632) that was believed to be exploited in the wild. This vulnerability was reported by an anonymous researcher and was patched on September 13, 2021 in Chrome version 93.0.4577.82. I’ll cover the root cause analysis of the bug, as well as detailed exploitation.

Back in October 2019 we detected a classic watering-hole attack that exploited a chain of Google Chrome and Microsoft Windows zero-days. In this blog post we’d like to take a deep technical dive into the attack.

IntroductionWhile DNS rebinding was first described nearly two decades ago, it has recently gained a second youth with the proliferation of insecure IoT devices and a series of highly publicized vulne…

In this post, we show how to reverse engineer the Magellan bug from the patch and exploit it on a 64bit desktop environment.

[ WebAsm OOB ArrayBuffer ] WebAsm instance builder reads imports from an attacker-controlled object in v8/src/wasm/wasm-module.cc:1625 ProcessImports(). Imports can be getters, which run while the ins…