Will Harris

Chrome Security gnome. I work on the sandbox and local data protection on Windows. @parityzero.99 on signal.

Opinions here are my own!

[Will Harris @parityzero]

Try out the early alpha of Process Isolation in Chrome 138. chrome://flags/#enable-process-isolation-ui then chrome://settings/system for the switch. Read known issues https://t.co/68RfiInChZ and report bugs! Especially interested in App-Compat bugs.

[Will Harris @parityzero]

@laparisa @googlechrome Why the green shopping bag?

[Will Harris @parityzero]

@bobmcmillan Should have used a stronger sandbox!

[Will Harris @parityzero]

Thinking of using CA private keys as my lottery numbers going forward! Wish me luck!

[Will Harris @parityzero]

@royalhansen My shirt melted when I went to Angkor Wat, it was so hot and humid there...

[Will Harris @parityzero]

@lcamtuf Once I burned my lips on a soldering iron trying to "ssshhh" someone.

[Will Harris @parityzero]

So I need to code twice as fast...?

[Parisa Tabriz @laparisa]

📢 @googlechrome is moving to a 2 week release cycle! More in https://t.co/C8ZQno3u6D

Also, a short history on browser update frequency:
• 2001: MSFT shipped IE6 & didn't release a major update for 5+ YEARS! Safari updated ~annually
• 2010: Chrome commits to 6-week releases & automatic updates. (People called us crazy.)
• 2021: Chrome updates to 4-week releases. (People said it was too fast.)
• 2026: Chrome goes to 2-week releases. (Opinions TBD :)

Release early, release often for fresher features and faster fixes... especially important with AI vuln discovery! 💪

[Jim Bankoski @jimbankoski]

@googlechrome is officially moving to a two-week release cycle starting today with Chrome 153, letting us deliver features and performance improvements faster than ever.
Cutting our release window in half also shrinks the "N-day" patch gap to an absolute minimum. This helps keep everyone protected against evolving threats as automated AI discovery tools generate higher patch volume. More on that here: https://t.co/i52nYUsjug

[Will Harris @parityzero]

@groby Have you consulted your doctor and asked what might be up?

[Will Harris @parityzero]

@susie_dent Does this word also apply to games I buy in the Steam Summer Sale but never play?

[DANΞ @cryps1s]

Our Black Hat talk on the OpenAI-Hugging Face incident is now live on youtube.

This is a watershed moment for the industry. I encourage all defenders to watch, consider how attack dynamics will imminently change, and plan for accelerating defense.

https://t.co/5B6k7YfpcP

[Will Harris @parityzero]

@0xcharlie The sooner we have the bug the sooner we are able to fix it for users. Breaking exploits with offset changes doesn't cause the bug to magically disappear or make users any safer.

[Will Harris @parityzero]

@0xcharlie We already tried to avoid releasing Chrome updates in the days leading up to pwn2own just in case a benign offset change meant we didn't get a juicy bug. Prefer to get the bug than not. Harder to avoid now though with weekly updates...

[Will Harris @parityzero]

@simplylurking2 Hmm, many techniques here might not work any more...? e.g. Secure Preferences now enabled on Enterprise and use App-Bound Encryption for hashes. Post what you find from your testing :)

[Will Harris @parityzero]

@simplylurking2 Setting Chrome policy needs admin though doesn't it...? HKCU policy keys are ACLed?

[Will Harris @parityzero]

@5aelo seems like strong CFI should be possible - I suppose I am talking both forward and backward edge, and maybe CET or some hardware support? I think this seems more achievable than 'solving the JIT problem' but I dunno

[Will Harris @parityzero]

@5aelo Why does building strong CFI also mean you can probably solve the JIT problem?

[Charlie Miller @0xcharlie]

pwn2own has always been a great datapoint for how hard it is to find vulns, what exploit mitigations are working, new exploitation techniques, and now how AI works on offensive security.

[Bobby Seagull MBE @Bobby_Seagull]

This young man Manchester Madgwick seems to know everything. What a mind. Bravo 👏🏻

#UniversityChallenge