Pinned Tweet
After Foxit, It was fun pwning Adobe Reader! Learned quite a lot of things. New achievement unlocked.
I and @shsirk submitted our Adobe Acrobat Reader DC UaF RCE exploit to @thezdi. This was an interesting bug to exploit as we faced quite a few challenges. Stay tuned for the blog post describing how we successfully achieve RCE.
youtube.com/watch?v=cguBkC0o…
Kernel UaF to Root, part 3:
Turning the address we leaked in part 2 into a kernel write, on a Pixel 6 running Android 12.
🔗Read: eshard.com/blog/kernel-uaf-t…
Krishs retweeted
Google awarded $113,337 USD for a Linux vulnerability discovered by Indonesian security researcher Muhammad Alifa Ramdhan (@n0psledbyte), who works as a Principal Vulnerability Researcher at @starlabs_sg. 🤯
Ramdhan discovered a Linux Local Privilege Escalation (LPE) vulnerability involving a race condition in AF_ALG, the same subsystem later exploited in the famous Copy Fail vulnerability in 2026. He found the issue in 2025 without AI assistance and it was assigned CVE-2025-39964.
His coworker, Bing-Jhong Billy Jheng, was also credited for completing the exploit chain, which enabled both privilege escalation to root and escape from a Docker container. They submitted the exploit to Google kernelCTF and received its highest reward. 💰
Ramdhan is from Tangerang, Indonesia. He graduated from Diponegoro University (@undip) in 2023 and later moved to Singapore to work full time as a vulnerability researcher. 🇮🇩 🇸🇬
idnsec.com/research/linux-lo…
Our own Mr. Q had his Chrome hack featured in the latest Phrack.
Since July and toward the end of the year, we are sharing our latest research at the following conferences: Black Hat USA, Unprompted.au, Blue Hat, Off By One, BSides Canberra, Hexacon, Objective By The Sea, and OffensiveCon.jp.
It's hard to believe we only launched this research program in March. It shows how much can be accomplished with AI and the right people working together.
We'll be sharing more fun results in the coming weeks. Stay tuned!
I used /goal + ASC + adb to analyze my phone. The agent pulled 50+ APKs with uid=1000, then used ASC to analyze them without exporting any pseudocode. After 10 hours, the agent had rooted my phone...😐
#mobile #bugbounty #security
github.com/MG1937/ASC
xitter.cf/MGAldys4/status/209854…
Guys, I built a super fast Android decompiler called ASC.
It completely replaced Jadx MCP for me and lets me analyze 10+ APKs in parallel.
And this week my Agent use ASC found 2 RCE in Honor and Xiaomi!
This tool now accepted by BlackHat EU Arsenal
github.com/MG1937
#BHEU
0-click exploit chain targeting Pixel 9, from RCE in mediacodec to kernel LPE (@natashenka and @__sethJenkins)
Part 1: projectzero.google/2026/01/p…
Part 2: projectzero.google/2026/01/p…
Part 3: projectzero.google/2026/01/p…
#infosec
Krishs retweeted
Sharing my for keynote talk for Offbyone security conference #OB12026 : <A year of hacking with LLMs>
sites.google.com/site/zhinia…
Today we published WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android.
We call you on WeChat and, without you answering or doing anything, take over your account within seconds. Then we use your phone to call your friends.
Story and demos: calif.io/research/weworm
(CVE-2026-87491)[543557673][wasm][sandbox]OOBW, exploited ITW
chromium.googlesource.com/v8…
PoC:
chromium.googlesource.com/v8…
Reported by Jihyeon Jeong:
chromereleases.googleblog.co…
Chained with CVE-2026-85046(type confusion -> arb r/w) & exploited itw, reported by Salvatore Gulizia (Serotav)
chromereleases.googleblog.co…
Fixed here:
chromium.googlesource.com/v8…
PoC:
chromium.googlesource.com/v8…
Writeup with exploitation:
serotav.github.io/Writeups/v…
CVE-2026-85046 is fun to read about
its type v8 confusion turns into
addrof ⇢ fakeobj ⇢ arbitary read/write
all from a browser page
Exploit Notes:
github.com/atiilla/CVE-2026-…
Krishs retweeted
github.com/wh1te4ever/xnu_1d…
I'm finally sharing my xnu_1day_practice project.
It documents I've studied on my own over the past year ..
Feel free to check it out if interested in researching XNU kernel vulnerability.
Krishs retweeted
Chaining three public V8 bugs to escape the V8 sandbox and recover a real Google v8CTF flag blog.himanshuanand.com/2026/…
Krishs retweeted
Exploitation steps and a reliable exploit for Google Chrome ITW V8 TryFastAddDataProperty vulnerability (CVE-2026-11645 [506689381]):
issues.chromium.org/issues/5…
Root cause of Google Chrome V8 ITW (CVE-2026-11645)[506689381]:
TryFastAddDataProperty[1] needs a fast MAP[5]. But "after" checking[2], Map::PrepareForDataProperty[3] manages to normalize the map. The patch[4] rechecks for slow dictionary MAP afterwards.
chromium-review.googlesource…
Krishs retweeted
Just published “Vulnerability Analysis of CVE 2025 22226 Information Disclosure Due to OOB Read in VMwares HGFS” by Alex Zaviyalov the first vulnerability in an ITW VMWare guest to host escape chain 👇
nccgroup.com/media/1mzfvyzl/…
Krishs retweeted
🔬Exploiting Mali GPU CVE-2025-8045 on Pixel 7 Pro!
Turning a double-free into a Dirty Pagetable primitive via race, timer-wheel calibration, and heap shaping.
Writeup: kuzey.rs/posts/MaliDF/
Code: github.com/kuzeyardabulut/CV…
#ExploitDevelopment #KernelSecurity #AndroidSecurity
New write-up with @GenericCoding on pois0nSword, our iOS 26.1 port of DarkSword: bypassing PAC to reach arbitrary native calls from a WebKit renderer R/W, by making dyld's own loader do the write.
varik.dev/blog/jsc/pois0nswo…
#WebKit #JavaScriptCore #iOS #exploitdev








































