Mmm

Chrome GPU sandbox escape and Anroid Kernel Stuff.

[Mmm @hackyzh]

It's extremely difficult. Let's see if this vulnerability can enable complete RCE without renderer RCE, relying on a single vulnerability.

[Mmm @hackyzh]

Android Security Bulletin—June 2026  |  Android Open Source Project

[Mmm @hackyzh]

@_deayzl Dude,you will get $500 from chrome vrp.😄

[Mmm @hackyzh]

@buptsb [TBD][513289241] Medium CVE-2026-10022: Type Confusion in V8. Reported by ggwhyp on 2026-05-14

[Mmm @hackyzh]

@buptsb 😅Some people are still submiting bugs.

[Mmm @hackyzh]

https://t.co/8JLTgaJaGT

[Mmm @hackyzh]

@roddux both,This is an obvious vulnerability; Claude could easily find it.

[Mmm @hackyzh]

@0vercl0k Most are reported by Google

[Mmm @hackyzh]

@1ce0ear 👍👋

[Mmm @hackyzh]

@Khalil_Zhani Good news!

[Mmm @hackyzh]

I'd like to ask everyone, after the Chrome VRP automatic update policy was implemented, are the bounties still being paid normally for vulnerabilities submitted before the new rules were introduced?🤣

[Mmm @hackyzh]

@h3xr4bb1t Is it from Renderer RCE to Sandbox Escape? That price is way too low.

[Mmm @hackyzh]

@cybaqkebm same as pj0.I don't know why Google defined it this way; perhaps they didn't consider the case of 0-click?

[Mmm @hackyzh]

Found 1 android 0-click memory corruption vuln.However, it seems that the upstream issue was resolved in March.🤡Fortunately, it was just a minor OOB read.#0click

[Mmm @hackyzh]

@canyie2977 No

[Mmm @hackyzh]

@h3xr4bb1t They need to create momentum.

[Mmm @hackyzh]

@calif_io These bounty are based old rules after new rules publish？

[Mmm @hackyzh]

@sirdarckcat Nice,Eduardo :)

[Mmm @hackyzh]

😅Chrome VRP is dead

[Google VRP (Google Bug Hunters) @GoogleVRP]

📣📢 Calling all Android and Chrome bug hunters 🧑‍💻🔎!

We're updating our Android & Chrome VRP programs to ensure we can continue to reward the most challenging and impactful vulnerabilities researchers find in our products. For details, 👇

https://t.co/hyZzEIampk

[Mmm @hackyzh]

`The controlled read or controlled write poc must be included in your initial report - we will not consider submissions added at a later time.` That's ridiculous.

[Mmm @hackyzh]

https://t.co/4CcQnCP0MP
Demonstrating controlled read or write
Mojom interfaces to demonstrate controlled reads or controlled writes in privileged processes are available in vrp_flags.mojom.