Ivan Fratric 💙💛

Tech lead and security researcher at Google Project Zero. Author: Jackalope, TinyInst, WinAFL, Domato. PhD. Tweets are my own.
Backup @[email protected]

[Ivan Fratric 💙💛 @ifsecure]

The slides for my Black Hat talk "XMPP Stanza Smuggling or How I Hacked Zoom" are now available at https://t.co/wZNGaBxKoa

[Seth Jenkins @__sethJenkins]

My and @natashenka 's talk from OffensiveCon is now available on YouTube! Watch for a tour of a zero-click to root exploit chain across multiple generations of Google Pixel!
https://t.co/9xvilxMUpM

[offensivecon @offensive_con]

Offensivecon's talks are now available on our YouTube channel!

🔗 https://t.co/cBmHPsj7qV

[Ivan Fratric 💙💛 @ifsecure]

@stdoutput Thanks! Will share the slides soon.

[Ivan Fratric 💙💛 @ifsecure]

In my OffensiveCon talk on Site Isolation yesterday, a question was asked that I didn't quite get at the moment so my answer was probably irrelevant. My apologies, especially since the question, as I understand it now, totally makes sense. Answering it here:

[Ivan Fratric 💙💛 @ifsecure]

I imagine the question was asked in reference to my 2nd demo, which admittedly wasn't very good in the sense that it showed a (partial) redirect url leak, but the url in that demo wasn't user specific.

[Ivan Fratric 💙💛 @ifsecure]

For that to happen, the request needs to be made with the user's (victim's) cookies. This is also the reason why disabling 3rd party cookies mitigates the attack.

[Ivan Fratric 💙💛 @ifsecure]

@julianor Details in 30 days :)

[Ivan Fratric 💙💛 @ifsecure]

CVE-2026-28920 (Apple, zlib, found by Brendon Tiszka of Google Project Zero) sure looks fun :)

[Ivan Fratric 💙💛 @ifsecure]

Turns out adapting our 0click chain to work on Pixel 10 wasn't that hard... at least if you're into Android drivers as much as @__sethJenkins.

[Natalie Silvanovich @natashenka]

.@__sethJenkins updated our 0-click exploit chain to work on a Pixel 10 with an eye-popping driver bug!

We’ll be presenting this work Saturday @offensive_con

https://t.co/KVWG3e7Rx0

[Natalie Silvanovich @natashenka]

.@__sethJenkins updated our 0-click exploit chain to work on a Pixel 10 with an eye-popping driver bug!

We’ll be presenting this work Saturday @offensive_con

https://t.co/KVWG3e7Rx0

[Samuel Groß @5aelo]

The fuzzer that found https://t.co/Y5DOo7QGHE (and a number of issues prior to that as well) is now open-source: https://t.co/zCdbHCpJ4z

It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!

[Seth Jenkins @__sethJenkins]

Just derestricted a now-fixed kernel bug in Pixel 10. I think this ranks as the most easily exploited kernel bug of all time😬

Thanks to @tehjh for collab'ing on this driver and full credits for noticing this bug in the first 5 minutes of auditing😂
https://t.co/hebHBfXB4F

[Ivan Fratric 💙💛 @ifsecure]

@cl4sm Yes, exactly, coverage is poor aproximation for state. I don't think better state approximation and mutational fuzzing are mutually exclusive, mutational fuzzer benefits from better state.

[Ivan Fratric 💙💛 @ifsecure]

I wrote a short blogpost on the quirks of grammar fuzzing (and, more generally, structure-aware fuzzing) and a simple trick I used to get more bugs out of it more quickly. https://t.co/65enmHATIb

[Ivan Fratric 💙💛 @ifsecure]

Jackalope and Tinyinst have been working on arm64 macs for a while, but now you should also be able to run against arm64e binaries (i.e. binaries that ship with the os) with some modification to the system. For details, see https://t.co/MTHmGCo3sA

[Natalie Silvanovich @natashenka]

In the final part of his blog series, @tiraniddo tells the story of how a bug was introduced into a Windows API.

Code re-writes can improve security, but it’s important not to forget the security properties the code needs to enforce in the process.

https://t.co/MZHNks6eGc

[Ivan Fratric 💙💛 @ifsecure]

How a single feature was responsible for 5 Windows Administrator Protection bypasses, in a new Project Zero blog post by @tiraniddo

[Natalie Silvanovich @natashenka]

Part 2 of @tiraniddo’s Windows Administrator Protection journey is here!

https://t.co/NrBMxb4Hh9

[Natalie Silvanovich @natashenka]

Part 2 of @tiraniddo’s Windows Administrator Protection journey is here!

https://t.co/NrBMxb4Hh9

[Ivan Fratric 💙💛 @ifsecure]

New Project Zero blogpost by @dillon_franke on exploiting a coreaudiod bug on macOS. Quite a journey with a lot of unexpected roadblocks and how Dillon pulled it off in the end. https://t.co/j4UdAgyJTX