Vulnerability Researcher

India
Joined October 2012
After Foxit, It was fun pwning Adobe Reader! Learned quite a lot of things. New achievement unlocked.
I and @shsirk submitted our Adobe Acrobat Reader DC UaF RCE exploit to @thezdi. This was an interesting bug to exploit as we faced quite a few challenges. Stay tuned for the blog post describing how we successfully achieve RCE. youtube.com/watch?v=cguBkC0o…
12
Krishs retweeted
Kernel UaF to Root, part 3: Turning the address we leaked in part 2 into a kernel write, on a Pixel 6 running Android 12. 🔗Read: eshard.com/blog/kernel-uaf-t…
18
60
2,315
Krishs retweeted
Replying to @0xdef1ant @aegiryy
oh
1
3,741
Krishs retweeted
CVE-2026-86950: The Great Glyph Grift calif.io/research/the-great-…
4
79
7
251
62,982
Krishs retweeted
Google awarded $113,337 USD for a Linux vulnerability discovered by Indonesian security researcher Muhammad Alifa Ramdhan (@n0psledbyte), who works as a Principal Vulnerability Researcher at @starlabs_sg. 🤯 Ramdhan discovered a Linux Local Privilege Escalation (LPE) vulnerability involving a race condition in AF_ALG, the same subsystem later exploited in the famous Copy Fail vulnerability in 2026. He found the issue in 2025 without AI assistance and it was assigned CVE-2025-39964. His coworker, Bing-Jhong Billy Jheng, was also credited for completing the exploit chain, which enabled both privilege escalation to root and escape from a Docker container. They submitted the exploit to Google kernelCTF and received its highest reward. 💰 Ramdhan is from Tangerang, Indonesia. He graduated from Diponegoro University (@undip) in 2023 and later moved to Singapore to work full time as a vulnerability researcher. 🇮🇩 🇸🇬 idnsec.com/research/linux-lo…
1
31
1
160
8,655
Krishs retweeted
Our own Mr. Q had his Chrome hack featured in the latest Phrack. Since July and toward the end of the year, we are sharing our latest research at the following conferences: Black Hat USA, Unprompted.au, Blue Hat, Off By One, BSides Canberra, Hexacon, Objective By The Sea, and OffensiveCon.jp. It's hard to believe we only launched this research program in March. It shows how much can be accomplished with AI and the right people working together. We'll be sharing more fun results in the coming weeks. Stay tuned!
1
20
112
16,413
Krishs retweeted
I used /goal + ASC + adb to analyze my phone. The agent pulled 50+ APKs with uid=1000, then used ASC to analyze them without exporting any pseudocode. After 10 hours, the agent had rooted my phone...😐 #mobile #bugbounty #security github.com/MG1937/ASC xitter.cf/MGAldys4/status/209854…
Guys, I built a super fast Android decompiler called ASC. It completely replaced Jadx MCP for me and lets me analyze 10+ APKs in parallel. And this week my Agent use ASC found 2 RCE in Honor and Xiaomi! This tool now accepted by BlackHat EU Arsenal github.com/MG1937 #BHEU
18
63
2
598
51,867
Krishs retweeted
0-click exploit chain targeting Pixel 9, from RCE in mediacodec to kernel LPE (@natashenka and @__sethJenkins) Part 1: projectzero.google/2026/01/p… Part 2: projectzero.google/2026/01/p… Part 3: projectzero.google/2026/01/p… #infosec
5
44
224
11,370
Krishs retweeted
Exploiting CVE-2026-19174: integer overflow in V8 WebAssembly qedaudit.io/blog/brilliantly… Credits @0x10n #infosec
1
34
1
197
9,590
Krishs retweeted
Today we published WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. We call you on WeChat and, without you answering or doing anything, take over your account within seconds. Then we use your phone to call your friends. Story and demos: calif.io/research/weworm
10
99
18
396
97,686
Krishs retweeted
(CVE-2026-87491)[543557673][wasm][sandbox]OOBW, exploited ITW chromium.googlesource.com/v8… PoC: chromium.googlesource.com/v8… Reported by Jihyeon Jeong: chromereleases.googleblog.co…
22
2
93
25,945
Krishs retweeted
CVE-2026-85046 is fun to read about its type v8 confusion turns into addrof ⇢ fakeobj ⇢ arbitary read/write all from a browser page Exploit Notes: github.com/atiilla/CVE-2026-…
1
9
56
4,988
github.com/wh1te4ever/xnu_1d… I'm finally sharing my xnu_1day_practice project. It documents I've studied on my own over the past year .. Feel free to check it out if interested in researching XNU kernel vulnerability.
7
47
280
17,147
Exploitation steps and a reliable exploit for Google Chrome ITW V8 TryFastAddDataProperty vulnerability (CVE-2026-11645 [506689381]): issues.chromium.org/issues/5…
Root cause of Google Chrome V8 ITW (CVE-2026-11645)[506689381]: TryFastAddDataProperty[1] needs a fast MAP[5]. But "after" checking[2], Map::PrepareForDataProperty[3] manages to normalize the map. The patch[4] rechecks for slow dictionary MAP afterwards. chromium-review.googlesource…
1
15
1
66
7,182
Just published “Vulnerability Analysis of CVE 2025 22226 Information Disclosure Due to OOB Read in VMwares HGFS” by Alex Zaviyalov the first vulnerability in an ITW VMWare guest to host escape chain 👇 nccgroup.com/media/1mzfvyzl/…
2
31
100
6,569
Krishs retweeted
My #BHUSA 2026 slides are online! It was an honor to share our AFD research and how a different perspective led to 30+ Windows kernel vulnerabilities. Blog post coming soon — check out the slides here: i.blackhat.com/BH-USA-26/Pre…
4
148
6
513
71,437