Ivan Fratric 💙💛

Tech lead and security researcher at Google Project Zero. Author: Jackalope, TinyInst, WinAFL, Domato. PhD. Tweets are my own.
Backup @[email protected]

[Ivan Fratric 💙💛 @ifsecure]

The slides for my Black Hat talk "XMPP Stanza Smuggling or How I Hacked Zoom" are now available at https://t.co/wZNGaBxKoa

[Ivan Fratric 💙💛 @ifsecure]

People often ask me how I think about fuzzers and other tooling in the age of AI. Instead of my opinion, here is some hard data by @5aelo.

[Natalie Silvanovich @natashenka]

LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer.

https://t.co/KTvm6k5Rhr

[Ivan Fratric 💙💛 @ifsecure]

I'm sure nobody will need to deploy an emergency fix anytime soon in this age of ai-written exploits. But maybe read below just in case ;)

[Natalie Silvanovich @natashenka]

All vendors should have a plan for rapid remediation in the case of active exploitation.

Here’s some emergency fix strategies we’ve seen over the years:

https://t.co/2hSqpoQbDp

[Natalie Silvanovich @natashenka]

All vendors should have a plan for rapid remediation in the case of active exploitation.

Here’s some emergency fix strategies we’ve seen over the years:

https://t.co/2hSqpoQbDp

[Ivan Fratric 💙💛 @ifsecure]

When an elevator closes, but a stairwell remains open

[Natalie Silvanovich @natashenka]

In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”.

But was it really fixed?

Ask @tiraniddo

https://t.co/4YgBY2N2KZ

[Natalie Silvanovich @natashenka]

In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”.

But was it really fixed?

Ask @tiraniddo

https://t.co/4YgBY2N2KZ

[Ivan Fratric 💙💛 @ifsecure]

New race condition tooling by @tehjh!

[Natalie Silvanovich @natashenka]

Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more!

https://t.co/Ae4sBBgiUU

[Ivan Fratric 💙💛 @ifsecure]

@R00tkitSMM @natashenka Likewise!

[Ivan Fratric 💙💛 @ifsecure]

At this year's OffensiveCon, @R00tkitSMM quite correctly pointed out to me that, on Apple devices, MTE can be used to get more reliable crashes while fuzzing. He also pointed out that Jackalope/TinyInst does not support binaries with MTE enabled and crashes. (1/2)

[Ivan Fratric 💙💛 @ifsecure]

The latest TinyInst includes a quick fix for that. It worked in my experiments, but if you encounter any other issues, please report them. Good for me that there is only one place in the TinyInst codebase from which all target process memory is read and written :) (2/2)

[Ivan Fratric 💙💛 @ifsecure]

In case you missed it!

[Natalie Silvanovich @natashenka]

Project Zero is hiring!

https://t.co/LTjxJTQ3DQ

Please share with anyone you think would be great for the role. DMs are open for questions.

[Natalie Silvanovich @natashenka]

Project Zero is hiring!

https://t.co/LTjxJTQ3DQ

Please share with anyone you think would be great for the role. DMs are open for questions.

[Michal Melewski @carste1n]

Finally it got published.

[Ivan Fratric 💙💛 @ifsecure]

@halvarflake My condolences.

[Ivan Fratric 💙💛 @ifsecure]

@halvarflake Don't know if it helps with Fable, but have you tried claude --safe-mode

[Seth Jenkins @__sethJenkins]

My and @natashenka 's talk from OffensiveCon is now available on YouTube! Watch for a tour of a zero-click to root exploit chain across multiple generations of Google Pixel!
https://t.co/9xvilxMUpM

[offensivecon @offensive_con]

Offensivecon's talks are now available on our YouTube channel!

🔗 https://t.co/cBmHPsj7qV

[Ivan Fratric 💙💛 @ifsecure]

@stdoutput Thanks! Will share the slides soon.

[Ivan Fratric 💙💛 @ifsecure]

It is true that you can query (e.g. via curl) a server and get a redirect url *if* that redirect url is not user-specific. However the idea of the talk was to leak redirect urls that contain sensitive information (such as the OAath access token in my 1st demo).

[Ivan Fratric 💙💛 @ifsecure]

@julianor Details in 30 days :)

[Ivan Fratric 💙💛 @ifsecure]

CVE-2026-28920 (Apple, zlib, found by Brendon Tiszka of Google Project Zero) sure looks fun :)

[Ivan Fratric 💙💛 @ifsecure]

Turns out adapting our 0click chain to work on Pixel 10 wasn't that hard... at least if you're into Android drivers as much as @__sethJenkins.

[Natalie Silvanovich @natashenka]

.@__sethJenkins updated our 0-click exploit chain to work on a Pixel 10 with an eye-popping driver bug!

We’ll be presenting this work Saturday @offensive_con

https://t.co/KVWG3e7Rx0