stratan

Introducing What The Claude: Browser Edition. A series where we pick apart browser bugs found/reported by Claude. First up: CVE-2026-2796, a SpiderMonkey Wasm import bug that leads to addrof/fakeobj/read-write. github.com/str8outtaheap/…

What The Claude, episode 3. We're taking a break from content-process RCEs for Bug 2022034. A raw NaN. Typed JS actor IPC. A parent-process fake object. An XUL leak. Code execution outside the sandbox. NaN around and find out. github.com/str8outtaheap/…

At Tashita, we always wanted a browser vulnerability research framework that researchers could actively guide and control over how research is conducted. Instead of forcing researchers to adapt to a tool, we built SeekZero to adapt to the researcher. That idea influenced almost every part of the platform. tashita.net/seekzero/

What makes SeekZero unique is not generic automation. It is the ability to connect researcher judgment, campaign-based workflows, execution feedback, orchestration, and AI-assisted systems into one programmable framework. We believe this is where browser vulnerability research is heading. tashita.net/seekzero/

We're wrapping up the CVE-2026-6307 series with special effects. Or better said: WasmFX. Follow along as @5tratan attempts to escape the v8 sandbox. tashita.net/turbofan-js-to…

We spent the last year developing SeekZero. We envolved years of research experience into a programmable system, designed from researchers to researchers. Today we're finally introducing it publicly. Really proud of what the team has built. A lot more to come!

Over the last year, we have been developing a framework for advanced browser vulnerability research. Today we are introducing SeekZero. SeekZero is a programmable JavaScript engine vulnerability research framework designed for researcher-guided automation, scalable execution, and highly customizable research workflows. Access is currently limited. tashita.net/seekzero/

What The Claude: Browser Edition, episode 2. This time: Bug 2024918. A phi node, SpiderMonkey's JIT pipeline, Wasm GC scalar replacement, escape analysis, and one wrong equality check. Let’s dive in. github.com/str8outtaheap/…

We said it was raining Chrome bugs. Part 2 brings the thunder. @5tratan continues the CVE-2026-6307 analysis, taking the TurboFan JS-to-Wasm deopt type confusion from root cause to PoC. tashita.net/turbofan-js-to…

It's been raining Chrome bugs lately, so we took a closer look. Part 1 by @5tratan is live: our analysis of CVE-2026-6307, a TurboFan JS-to-Wasm deopt type confusion bug. We cover the trigger and the background needed to follow along. tashita.net/turbofan-js-to…

.@TashitaSoftSec 's mission is to revolutionise how security research is performed, by developing the most advanced vulnerability research frameworks. Join us and become part of an epic adventure! Career opportunities: tashita.net/careers/ DMs are open!

New blogpost by @0vercl0k "A journey into IonMonkey: root-causing CVE-2019-9810" doar-e.github.io/blog/2019/06/1…

Just uploaded on @doar_e my slides for my @typhooncon talk on exploiting chrome by attacking TurboFan. Thanks @SecuriTeam_SSD for the opportunity to present :-) doar-e.github.io/presentations/…

New blogpost by @__x86 "Circumventing Chrome's hardening of typer bugs" doar-e.github.io/blog/2019/05/0…

phrack.org/papers/jit_exp… #phrack :)

[BLOG] An overview of macOS kernel debugging blog.quarkslab.com/an-overview-of… Deep dive into Kernel Debugging Protocol (KDP), from implementation to limitation

The detail of my p2o entry: github.com/hongphipham95/…

Fuzzilli, my JavaScript engine fuzzer, is now open source: github.com/googleprojectz… \o/ Keep an eye on the Project Zero bugtracker in the next few weeks for some of the bugs found with it. Also let me know if you encounter any problems when using it! :)

@rkmylo and I are kicking off our WebKit research debut by pwning CVE-2018-4441. Feedback is much appreciated! melligra.fun/webkit/2019/02…

New blogpost by @0vercl0k "Introduction to SpiderMonkey exploitation" doar-e.github.io/blog/2018/11/1…, GitHub repo: github.com/0vercl0k/blaze…