Zero Day Engineering

State-of-the-art vulnerability research & exploit intelligence • @alisaesage @zerodaytraining

[Zero Day Engineering @zerodayalpha]

New Zero Day Engineering research: Chrome Exploit Mitigations, by @alisaesage https://t.co/vMRAk24Zhi

[Zero Day Engineering | Training & Courses @zerodaytraining]

Summer Research Bundles https://t.co/raLGDrDrbw

[Alisa Esage Шевченко @alisaesage]

Whatever Anthropic provided to Google, didn’t include the 0-days in Chrome that I am reporting right now. Zero dupes so far

[Zero Day Engineering @zerodayalpha]

Browser Exploit Design course – advanced pwn, take Complete package for technical support with @alisaesage: https://t.co/AOkbheuyjK

Zero Day Vulnerability research - foundations: https://t.co/ag9ZQLosQy

[Zero Day Engineering @zerodayalpha]

⚡️0-Day Alert: Google Chrome GPU Remote to Elevation of Privilege exploit in the wild

CVE-2026-5281: Dawn Server Use-after-free due to improper clearing of callbacks upon DeviceInfo object destruction

🔒Issue: https://t.co/ytqAwgMAJM

The bug is interesting: a partial EoP that can potentially be triggered remotely via WebGPU API calls. Normally this chain of impact requires at least 2-3 separate bugs. The fact that it was cherry-picked to M146 confirms high-to-critical impact.

Patched in 146.0.7680.177/178 for Windows/Mac and 146.0.7680.177 for Linux on 31st March

[Zero Day Engineering @zerodayalpha]

We're looking at Skia exploits – here is an insight blog from 2023 with some extra context: https://t.co/lT5oJIirgt

v8 zero to exploit: https://t.co/GuF3Tbpuws

[Zero Day Engineering @zerodayalpha]

⚡️0-Day Alert: Google Chrome RCE + EoP in the wild

• CVE-2026-3910: v8 Maglev JIT incorrect write barrier elimination for Smi representation in Phi edge cases => UaF or memory corruption

Impact: remote ACE in renderer via JavaScript code.

Same structural pattern invariant as seen in a recent WebKit jsc bug.

• CVE-2026-3909: Skia glyph cache key collision to out-of-bounds write in GPU process

Impact: at least a partial (full on some platforms) Sandbox Escape primitive.

Potentially reachable remotely via renderer media formats.

In the specific exploit it was likely pushed directly to IPC from a compromised renderer via CVE-2026-3910.

Both bugs patched since Chrome 146.0.7680.80 for Windows/Mac and 146.0.7680.80 for Linux

[Zero Day Engineering @zerodayalpha]

https://t.co/ydzklyraga

[Zero Day Engineering @zerodayalpha]

How to find zero-days with AI

1. Take one of our specialized trainings to know what you're doing + set up research platform + chat with a pro.

2. Use your favorite AI to find the bug.

3. Profit.

[Zero Day Engineering @zerodayalpha]

Michal took both Browser Exploit Design and Hypervisor Vulnerability Research courses at once – a correct way of learning for someone who wants to uncover deep structural invariants between seemingly different categories of target.

https://t.co/ydzklyraga

[Zero Day Engineering @zerodayalpha]

"A clear, internally coherent theory of each subject, something I haven't seen elsewhere. It fundamentally changed how I approach these topics, and brought me much-desired clarity."

– Michal Siran, Malware Researcher, OSCE3

[Alisa Esage Шевченко @alisaesage]

I don’t think the world is ready for the zero day apocalypse that’s upon it.

Cost of entry was the only real constraint on ethics of the game. Given current AI, it no longer holds.

Who pays more for the bug is the only question now.

Critical software vendors that don’t have a good bug bounty program are screwed.

[Zero Day Engineering @zerodayalpha]

All our specialized courses have Research Platform Setup as a mandatory module. It includes instructions for self-build environment, basic CPU- and source-level debugging, ASAN builds, useful process flags and undocumented configurations.

Hypervisor Vulnerability Research students internalize the multi-VM hypervisor debugging setup at a generative level that stays relevant even as surface tools change: https://t.co/6llUH9lRd3

Browser Exploit Design has a pre-computed downloadable VM plus a DIY build document: https://t.co/JJfsQZ4UmH

Proper platform setup is one of the most demanding tasks of the vulnerability research pipeline. Once set up, maintenance is routine, testing of 0-days is straightforward, and your bug reports no longer get dismissed as theoretical.

[Zero Day Engineering @zerodayalpha]

Google VRP recently rolled out an emergency update to bug report criteria.

New rules strictly require a minimized PoC and, for memory safety issues, an ASAN trace.

Everybody loves ASAN traces.

[Zero Day Engineering @zerodayalpha]

CVE-2026-21385 is similar to kgsl bugs that we covered in this 0-Day Insights note: https://t.co/CgfPVvrxch

Both 0-Day Alerts and 0-Day Insights are fractional samples of our Alpha intelligence subscription.

Contact us to learn more.

https://t.co/yIKr8SEcWa

[Zero Day Engineering @zerodayalpha]

⚡️0-Day Alert: Android Qualcomm msm kernel - exploit in-the-wild since December 2025.

CVE-2026-21385: kgsl uses unsanitized alignment parameter from ioctl and other input vectors to calculate GPU memory allocation variables, leading to memory corruption via an integer overflow.

The bug primitive is powerful enough to allow Elevation of Privilege – not just OOBR.

kgsl is an open source GPU driver in Qualcomm msm kernel that ships in many Android devices.

Patched in 2026-03-05 Android security update.

[Alisa Esage Шевченко @alisaesage]

Cybersecurity in 2026

- An exploit from 2008 in Microsoft ActiveX on CISA KEV list.
- CVSS 10.0 because someone hardcoded a password again.
- Another boring Chrome RCE blows up on Hacker News like it's a hypervisor escape.
- People reposting opportunistic AI-gen noise and fake exploit PoCs very hard.
- 0 experts surprised

[Zero Day Engineering @zerodayalpha]

Apple recently patched the missing piece in the userland part of the Dec'25 full-chain exploit.

CVE-2026-20700: dyld memory corruption to PAC bypass

This bug completes the chain of CVE-2026-43529 (jsc UAF RCE, PoC public) and CVE-2026-14174 (Angle OOB EoP, no working PoC yet).

Patched in iOS 26.3

[Zero Day Engineering @zerodayalpha]

🚨 0-Day Alert: Full-chain exploit for Apple Safari/WebKit in the wild (just patched)

CVE-2025-43529: UaF in JSC Escape Analysis (RCE)
CVE-2025-14174: Buffer Overflow in ANGLE (Sandbox Escape)

⚠️The sandbox escape bug is same as reported in Chrome last week

[Zero Day Engineering @zerodayalpha]

"The knowledge and skills I gained reshaped my identity as a researcher. They apply across systems and disciplines. Techniques refined my approach, while methodology and models changed how I operate at the root." – M. Giovanni Sagioro, Security Researcher

https://t.co/ag9ZQLnV10

[7h3h4ckv157 @7h3h4ckv157]

She’s one the best hacker in the 🌍

Check this out: