𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔

Alpha Lab.

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

Glad to be here again, #1 this year. Thanks to everyone, and still the same as I said last year, the Chrome team and the VRP team are indeed excellent teams.

[Google VRP (Google Bug Hunters) @GoogleVRP]

📯As we wrap up 2022, the Chrome VRP is pleased to announce the top Chrome VRP Researchers of 2022. Congratulations and great work!
Thank you for all your contributions and efforts over this past year & helping us make Chrome Browser and Chrome OS more secure for all users!

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

A sad story, waiting for the pre-recorded video.🐰

[Jr @__R0ng]

My virtual session at BlackHat has been canceled halfway (due to connecting issue I think?) 😔 I wonder if it's just me or such things may happen in other session

[Project Zero Bugs @ProjectZeroBugs]

Chrome: State tracking issue in RenderFrameHostImpl leading to UaF https://t.co/VIOEdD1qsG

[Chromium Disclosed Security Bugs @BugsChromium]

Security: heap-use-after-free in content::RenderFrameHostImpl::delegate https://t.co/rYDGWpRDqd

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

@cengaver @GoogleVRP thanks😃

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

Honored to be #0. Special thanks to the VRP team and the Chrome team for their assistance in the past year, they are indeed excellent teams.

[Google VRP (Google Bug Hunters) @GoogleVRP]

As we are wrapping up 2021, the Chrome VRP is pleased to announce the Top 20 Chrome VRP Researchers for this year. Congratulations and great work!
Thank you for your contributions and efforts over this past year in helping us make Chrome Browser and Chrome OS safe for all users!

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

@hackyzh @GoogleVRP 他们原则上只认少量用户交互的。大量用户交互或者webui的一般就取决于具体的审洞人怎么看了。我感觉最近公开的好多需要大量交互或者特别苛刻的条件竞争都不该被认的，但他们也都认了，所以这种完全取决于审洞人心情🤣

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

@_3ndy1 Your avatar is so 456

[Samuel Groß @5aelo]

This week we are starting an experiment that enables V8's Virtual Memory Cage in Chrome on Desktop (currently only on Dev + Canary channels, then Beta and finally Stable). Here is how that'll work:

[Black Hat @BlackHatEvents]

All videos from #BHUSA 2021 are now live on our YouTube channel. Check them out here! - https://t.co/297roa9Mgb

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

@uromise @oooverflow Great romise😍

[Samuel Groß @5aelo]

Designing a sandbox for V8: https://t.co/YwEWLxXpoF

[RET2 Systems @ret2systems]

Check out how we used 32gb of RAM to exploit a zero-day WebAssembly Vulnerability (CVE-2021-30734) in Apple Safari / JavaScriptCore at #Pwn2Own in 2021:

https://t.co/CCcc5RVugk

[SorryMybad @S0rryMybad]

I suggest v8 dev consider to refactor part of the typer system. It seems like hard to kill all typer bugs and system is very friendly for exploitation. I've thought about it and have some ideas. Welcome everyone to discuss.@v8js

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

SorryMyReal0Day

[SorryMybad @S0rryMybad]

The REAL 0 day: Tested On Canary Version

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

@S0rryMybad @guhe120 can't agree more

[𝕷𝖊𝖊𝖈𝖗𝖆𝖘𝖔 @leecraso]

@Ox9A82 gangster!

[stephen @_tsuro]

I made a website: https://t.co/4KJAv1BOzY

[Man Yue Mo @mmolgtm]

In this series of posts I'll exploit 3 bugs that I reported last year. Together they can form a full chain from Chrome beta v86 to the Android kernel. The first post is about exploiting a UAF in the kernel reachable from the App sandbox: https://t.co/A7RIzV3RoF