Welcome to the new Project Zero Blog
Thinking Outside The Box [dusted off draft from 2017]
Windows Exploitation Techniques: Winning Race Conditions with Path Lookups
A look at an Android ITW DNG exploit
Defeating KASLR by Doing Nothing at All
Pointer leaks through pointer-keyed data structures
From Chrome renderer code exec to kernel with MSG_OOB
Policy and Disclosure: 2025 Edition
The Windows Registry Adventure #8: Practical exploitation of hive memory corruption
The Windows Registry Adventure #7: Attack surface analysis
Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages
The Windows Registry Adventure #6: Kernel-mode objects
Blasting Past Webp
Windows Exploitation Tricks: Trapping Virtual Memory Access (2025 Update)
Windows Bug Class: Accessing Trapped COM Objects with IDispatch
The Windows Registry Adventure #5: The regf file format
The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit
Windows Tooling Updates: OleView.NET
Simple macOS kernel extension fuzzing in userspace with IDA and TinyInst
From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code
The Windows Registry Adventure #4: Hives and the registry layout
Effective Fuzzing: A Dav1d Case Study
The Windows Registry Adventure #3: Learning resources
Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models
Driving forward in Android drivers
The Windows Registry Adventure #2: A brief history of the feature
The Windows Registry Adventure #1: Introduction and research results
First handset with MTE on the market
An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit
Analyzing a Modern In-the-wild Android Exploit
Summary: MTE As Implemented
MTE As Implemented, Part 3: The Kernel
MTE As Implemented, Part 2: Mitigation Case Studies
MTE As Implemented, Part 1: Implementation Testing
Release of a Technical Report into Intel Trust Domain Extensions
Multiple Internet to Baseband Remote Code Execution Vulnerabilities in Exynos Modems
Exploiting null-dereferences in the Linux kernel
DER Entitlements: The (Brief) Return of the Psychic Paper
Exploiting CVE-2022-42703 - Bringing back the stack attack
Mind the Gap
A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain
Gregor Samsa: Exploiting Java's XML Signature Verification
RC4 Is Still Considered Harmful
The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)
2022 0-day In-the-Wild Exploitation…so far
The curious tale of a fake Carrier.app
An Autopsy on a Zombie In-the-Wild 0-day
Release of Technical Report into the AMD Security Processor
The More You Know, The More You Know You Don’t Know
CVE-2021-1782, an iOS in-the-wild vulnerability in vouchers
CVE-2021-30737, @xerub's 2021 iOS ASN.1 Vulnerability
FORCEDENTRY: Sandbox Escape
Racing against the clock -- hitting a tiny kernel race window
A walk through Project Zero metrics
Zooming in on Zero-click Exploits
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
This shouldn't have happened: A vulnerability postmortem
Windows Exploitation Tricks: Relaying DCOM Authentication
Using Kerberos for Authentication Relay Attacks
How a simple Linux kernel memory corruption bug can lead to complete system compromise
Fuzzing Closed-Source JavaScript Engines with Coverage Feedback
Understanding Network Access in Windows AppContainers
An EPYC escape: Case-study of a KVM breakout
Fuzzing iOS code on macOS at native speed
Designing sockfuzzer, a network syscall fuzzer for XNU
Policy and Disclosure: 2021 Edition
Who Contains the Containers?
In-the-Wild Series: October 2020 0-day discovery
Déjà vu-lnerability
A Look at iMessage in iOS 14
Windows Exploitation Tricks: Trapping Virtual Memory Access
The State of State Machines
Hunting for Bugs in Windows Mini-Filter Drivers
Introducing the In-the-Wild Series
In-the-Wild Series: Windows Exploits
In-the-Wild Series: Chrome Infinity Bug
In-the-Wild Series: Chrome Exploits
In-the-Wild Series: Android Post-Exploitation
In-the-Wild Series: Android Exploits
An iOS hacker tries Android
An iOS zero-click radio proximity exploit odyssey
Oops, I missed it again!
Enter the Vault: Authentication Issues in HashiCorp Vault
Announcing the Fuzzilli Research Grant Program
Attacking the Qualcomm Adreno GPU
JITSploitation II: Getting Read/Write
JITSploitation III: Subverting Control Flow
JITSploitation I: A JIT Bug
MMS Exploit Part 5: Defeating Android ASLR, Getting RCE
Exploiting Android Messengers with WebRTC: Part 3
Exploiting Android Messengers with WebRTC: Part 2
MMS Exploit Part 4: MMS Primer, Completing the ASLR Oracle
Exploiting Android Messengers with WebRTC: Part 1
The core of Apple is PPL: Breaking the XNU kernel's kernel
One Byte to rule them all
Root Cause Analyses for 0-day In-the-Wild Exploits
Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019
MMS Exploit Part 3: Constructing the Memory Corruption Primitives
MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec
MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface
How to unc0ver a 0-day in 4 hours or less
FF Sandbox Escape (CVE-2020-12388)
A survey of recent iOS kernel exploits
Fuzzing ImageIO
You Won't Believe what this One Line Change Did to the Chrome Sandbox
TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln
Escaping the Chrome Sandbox with RIDL
Mitigations are attack surface, too
A day^W^W Several months in the life of Project Zero - Part 2: The Chrome exploit of suffering
A day^W^W Several months in the life of Project Zero - Part 1: The Chrome bug of suffering
Part II: Returning to Adobe Reader symbols on macOS
Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution
Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass
Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641
Policy and Disclosure: 2020 Edition
Calling Local Windows RPC Servers from .NET
SockPuppet: A Walkthrough of a Kernel Exploit for iOS 12.4
Bad Binder: Android In-The-Wild Exploit
KTRW: The journey to build a debuggable iPhone
The story of Adobe Reader symbols
Windows‌ ‌Exploitation‌ ‌Tricks:‌ ‌Spoofing‌ ‌Named‌ ‌Pipe‌ ‌Client‌ ‌PID‌
JSC Exploits
In-the-wild iOS Exploit Chain 5
In-the-wild iOS Exploit Chain 4
In-the-wild iOS Exploit Chain 3
In-the-wild iOS Exploit Chain 2
In-the-wild iOS Exploit Chain 1
Implant Teardown
A very deep dive into iOS Exploit chains found in the wild
The Many Possibilities of CVE-2019-8646
Down the Rabbit-Hole...
The Fully Remote Attack Surface of the iPhone
Trashing the Flow of Data
Windows Exploitation Tricks: Abusing the User-Mode Debugger
Virtually Unlimited Memory: Escaping the Chrome Sandbox
Splitting atoms in XNU
Windows Kernel Logic Bug Class: Access Mode Mismatch in IO Manager
Android Messaging: A Few Bugs Short of a Chain
The Curious Case of Convexity Confusion
Examining Pointer Authentication on the iPhone XS
voucher_swap: Exploiting MIG reference counting in iOS 12
Taking a page from the kernel's book: A TLB issue in mremap()
On VBScript
Searching statically-linked vulnerable library functions in executable code
Adventures in Video Conferencing Part 5: Where Do We Go from Here?
Adventures in Video Conferencing Part 4: What Didn't Work Out with WhatsApp
Adventures in Video Conferencing Part 3: The Even Wilder World of WhatsApp
Adventures in Video Conferencing Part 2: Fun with FaceTime
Adventures in Video Conferencing Part 1: The Wild World of WebRTC
Injecting Code into Windows Protected Processes using COM - Part 2
Heap Feng Shader: Exploiting SwiftShader in Chrome
Deja-XNU
Injecting Code into Windows Protected Processes using COM - Part 1
365 Days Later: Finding and Exploiting Safari Bugs using Publicly Available Tools
A cache invalidation bug in Linux memory management
OATmeal on the Universal Cereal Bus: Exploiting Android phones over USB
The Problems and Promise of WebAssembly
Windows Exploitation Tricks: Exploiting Arbitrary Object Directory Creation for Local Elevation of Privilege
Adventures in vulnerability reporting
Drawing Outside the Box: Precision Issues in Graphic Libraries
Detecting Kernel Memory Disclosure – Whitepaper
Bypassing Mitigations by Attacking JIT Server in Microsoft Edge
Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege
Reading privileged memory with a side-channel
aPAColypse now: Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript
Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices
Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs
Over The Air - Vol. 2, Pt. 2: Exploiting The Wi-Fi Stack on Apple Devices
Over The Air - Vol. 2, Pt. 1: Exploiting The Wi-Fi Stack on Apple Devices
The Great DOM Fuzz-off of 2017
Bypassing VirtualBox Process Hardening on Windows
Windows Exploitation Tricks: Arbitrary Directory Creation to Arbitrary File Read
Trust Issues: Exploiting TrustZone TEEs
Exploiting the Linux kernel via packet sockets
Exploiting .NET Managed DCOM
Exception-oriented exploitation on iOS
Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2)
Notes on Windows Uniscribe Fuzzing
Pandavirtualization: Exploiting the Xen hypervisor
Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 1)
Project Zero Prize Conclusion
Attacking the Windows NVIDIA Driver
Lifting the (Hyper) Visor: Bypassing Samsung’s Real-Time Kernel Protection
Chrome OS exploit: one byte overflow and symlinks
BitUnmap: Attacking Android Ashmem
Breaking the Chain
task_t considered harmful
Announcing the Project Zero Prize
Return to libstagefright: exploiting libutils on Android
A Shadow of our Former Self
A year of Windows kernel font fuzzing #2: the techniques
How to Compromise the Enterprise Endpoint
A year of Windows kernel font fuzzing #1: the results
Exploiting Recursion in the Linux Kernel
Life After the Isolated Heap
Race you to the kernel!
Exploiting a Leaked Thread Handle
The Definitive Guide on Win32 to NT Path Conversion
Racing MIDI messages in Chrome
Raising the Dead
FireEye Exploitation: Project Zero’s Vulnerability of the Beast
Between a Rock and a Hard Link
Windows Sandbox Attack Surface Analysis
Hack The Galaxy: Hunting Bugs in the Samsung Galaxy S6 Edge
Windows Drivers are True’ly Tricky
Revisiting Apple IPC: (1) Distributed Objects
Kaspersky: Mo Unpackers, Mo Problems.
Stagefrightened?
Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure
Windows 10^H^H Symbolic Link Mitigations
One font vulnerability to rule them all #4: Windows 8.1 64-bit sandbox escape exploitation
Three bypasses and a fix for one of Flash's Vector.<*> mitigations
Attacking ECMAScript Engines with Redefinition
One font vulnerability to rule them all #3: Windows 8.1 32-bit sandbox escape exploitation
One font vulnerability to rule them all #2: Adobe Reader RCE exploitation
One font vulnerability to rule them all #1: Introducing the BLEND vulnerability
One Perfect Bug: Exploiting Type Confusion in Flash
Significant Flash exploit mitigations are live in v18.0.0.209
From inter to intra: gaining reliability
When ‘int’ is the new ‘short’
What is a "good" memory corruption vulnerability?
Analysis and Exploitation of an ESET Vulnerability
Owning Internet Printing - A Case Study in Modern Software Exploitation
Dude, where’s my heap?
In-Console-Able
A Tale of Two Exploits
Taming the wild copy: Parallel Thread Corruption
Exploiting the DRAM rowhammer bug to gain kernel privileges Rowhammer blog post (draft)
Feedback and data-driven updates to Google’s disclosure policy
(^Exploiting)\s*(CVE-2015-0318)\s*(in)\s*(Flash$)
A Token’s Tale
Exploiting NVMAP to escape the Chrome sandbox - CVE-2014-5332
Finding and exploiting ntpd vulnerabilities
Internet Explorer EPM Sandbox Escape CVE-2014-6350
pwn4fun Spring 2014 - Safari - Part II
Project Zero Patch Tuesday roundup, November 2014
Did the “Man With No Name” Feel Insecure?
More Mac OS X and iPhone sandbox escapes and kernel bugs
Exploiting CVE-2014-0556 in Flash
The poisoned NUL byte, 2014 edition
What does a pointer look like, anyway?
Mac OS X and iPhone sandbox escapes
pwn4fun Spring 2014 - Safari - Part I
Announcing Project Zero