Carl Smith がリツイート
#Zer0Con2026 - SPEAKER 🎃
Pumpkin Chang(@u1f383) from DEVCORE - “Modern Android Kernel Exploitation Through a Mali Driver Vulnerability”
For more: zer0con.org
English
Carl Smith
316 posts
Carl Smith
@cffsmith
Security @Google; @FluxFingers/@Sauercl0ud; previously V8 Security, Intern {Project Zero, @XI_Research}. Personal account. https://t.co/w9zosKSHdh on Bluesky.
Switzerland, Germany, USA 参加日 Mayıs 2014
720 フォロー中1.1K フォロワー
Carl Smith がリツイート
#Zer0Con2026 - SPEAKER 🌌
Brendon Tiszka from Google Project Zero - “Researcher’s Guide to the Galaxy: Digging into Samsung 0-click, Android Messengers, DNG, and other image formats”
For more: zer0con.org
English
Carl Smith がリツイート
We derestricted crbug.com/382005099 today which might just be my favorite bug of the last few years: bad interaction between WebAudio changing the CPU's handling of floats and V8 not expecting that. See #comment19" target="_blank" rel="nofollow noopener">crbug.com/382005099#comm… for a PoC exploit. Also affected other browsers
English
Carl Smith がリツイート
I'm pretty excited about this (POE2 in particular)! It's basically what we've been preparing for with the PKEY-based hardware sandboxing prototype for V8 (docs.google.com/document/d/1l3…)
Dmitry Vyukov@dvyukov
More HW security goodness from Arm: community.arm.com/arm-community-… vMTE (Virtual Memory Tagging) allows to use MTE in a more flexible way, consuming less RAM. POE2 allows to build efficient in-process sandboxes and isolation. More-or-less improvement over x86 Memory Protection Keys.
English
Carl Smith がリツイート
If you like Chrome IPC shenanigans like this, you might also enjoy my talk from black hat 25: youtu.be/qhhJCLy0YBA?si…
YouTube
xvonfers@xvonfers
Whoah... $250000 (CVE-2025-4609, similar to CVE-2025-2783/412578726)[412578726][Mojo][IpczDriver]ipcz bug -> renderer duplicate browser process handle -> escape sbx is now open with PoC & exploit(success rate is nearly 70%-80%) issues.chromium.org/issues/4125787… #comment11" target="_blank" rel="nofollow noopener">issues.chromium.org/issues/4125787…
English
Carl Smith がリツイート
That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes)
googleprojectzero.blogspot.com/2025/08/from-c…
English
Carl Smith がリツイート
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectz…
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
English
Carl Smith がリツイート
If you have a machine with PKEY support and recent Linux kernel you can now play around with hardware support for the V8 sandbox. When active, JS + Wasm code has no write permissions outside the sandbox address space. To enable, set `v8_enable_sandbox_hardware_support = true`.
English
Carl Smith がリツイート
@mistymntncop I've also updated our V8 Exploit Tracker sheet now: docs.google.com/document/d/1nj… (see the 2025 tab) :)
English
Carl Smith がリツイート
...and now, introducing Part 6 of @j00ru's work on the Windows Registry:
googleprojectzero.blogspot.com/2025/04/the-wi…
📖👀
Tim Willis@itswillis
Part 5 of @j00ru's Windows Registry Adventure is out! googleprojectzero.blogspot.com/2024/12/the-wi… Incredible depth of knowledge on display, and good to see it shared as a reference with the world ❤️
English
Carl Smith がリツイート
My writeup of the 2023 NSO in-the-wild iOS zero-click BLASTDOOR webp exploit: Blasting Past Webp -
googleprojectzero.blogspot.com/2025/03/blasti…
English
Carl Smith がリツイート
Senior Software Engineer, V8 Bug Detection: google.com/about/careers/…
Software Engineer II, V8 Bug Detection:
google.com/about/careers/…
English
Carl Smith がリツイート
Carl Smith がリツイート
I tweeted before about the Apple CoreAudio issues found by Google TAG. Well, the fuzz harness used to find these issues is now included in Jackalope examples, see github.com/googleprojectz… . Happy fuzzing! :)
Ivan Fratric 💙💛@ifsecure
The latest Apple security update contains fixes for three CoreAudio issues (CVE-2025-24160, CVE-2025-24161, CVE-2025-24163). These were found by Google Threat Analysis Group using Jackalope fuzzer.
English
Carl Smith がリツイート
Congratulations to Carl Smith from v8 Security team and join Blackhat USA review board as guest reviewer. He is willing to share, and an open-minded, hardcore researcher and developer.
@cffsmith
@BlackHatEvents
English
Some slides discussing some of this work can be found here:
powerofcommunity.net/poc2024/Carl%2…
English
I’m very excited to announce that we at V8 Security have finally published our first version of Fuzzilli that understands Wasm!
Go check it out at github.com/googleprojectz….
While we still have a way to go in improving it, we think it shows a promising approach!
English
Carl Smith がリツイート
meow meow meow meow meow meowwww
cats with jobs 🛠@CatWorkers
What kind of email is she sending?
English
Carl Smith がリツイート
"Invariant inversion" in memory-unsafe languages
pacibsp.github.io/2024/invariant…
English