Ivan Fratric 💙💛

The slides for my Black Hat talk "XMPP Stanza Smuggling or How I Hacked Zoom" are now available at #xmpp-stanza-smuggling-or-how-i-hacked-zoom-26618" target="_blank" rel="nofollow noopener">blackhat.com/us-22/briefing…

@halvarflake Don't know if it helps with Fable, but have you tried claude --safe-mode

The experience of being told by Fable over and over again that "all your thoughts trigger downgrade" is not great. Is there a way to just zap everything that Anthropic knows about me and start from scratch?

My and @natashenka 's talk from OffensiveCon is now available on YouTube! Watch for a tour of a zero-click to root exploit chain across multiple generations of Google Pixel! youtube.com/watch?v=jpB_b6…

Offensivecon's talks are now available on our YouTube channel! 🔗 buff.ly/g63xgm5

@stdoutput Thanks! Will share the slides soon.

@ifsecure Any chance you could share the slides? Thanks for the great talk!

In my OffensiveCon talk on Site Isolation yesterday, a question was asked that I didn't quite get at the moment so my answer was probably irrelevant. My apologies, especially since the question, as I understand it now, totally makes sense. Answering it here:

I imagine the question was asked in reference to my 2nd demo, which admittedly wasn't very good in the sense that it showed a (partial) redirect url leak, but the url in that demo wasn't user specific.

For that to happen, the request needs to be made with the user's (victim's) cookies. This is also the reason why disabling 3rd party cookies mitigates the attack.

@julianor Details in 30 days :)

@ifsecure info leak?

CVE-2026-28920 (Apple, zlib, found by Brendon Tiszka of Google Project Zero) sure looks fun :)

Turns out adapting our 0click chain to work on Pixel 10 wasn't that hard... at least if you're into Android drivers as much as @__sethJenkins.

.@__sethJenkins updated our 0-click exploit chain to work on a Pixel 10 with an eye-popping driver bug! We’ll be presenting this work Saturday @offensive_con projectzero.google/2026/05/pixel-…

The fuzzer that found project-zero.issues.chromium.org/issues?q=compo… (and a number of issues prior to that as well) is now open-source: crrev.com/c/7580844 It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!

Just derestricted a now-fixed kernel bug in Pixel 10. I think this ranks as the most easily exploited kernel bug of all time😬 Thanks to @tehjh for collab'ing on this driver and full credits for noticing this bug in the first 5 minutes of auditing😂 project-zero.issues.chromium.org/issues/4634382…

@cl4sm Yes, exactly, coverage is poor aproximation for state. I don't think better state approximation and mutational fuzzing are mutually exclusive, mutational fuzzer benefits from better state.

@ifsecure Cool blog! The first problem feels like an issue with coverage being a poor approx. for program state. But approaches like IJON haven’t seen much success AFAIK in the real world. Do you think prob 1 gets fixed with better state approx or is the mutational fuzzer still needed?

I wrote a short blogpost on the quirks of grammar fuzzing (and, more generally, structure-aware fuzzing) and a simple trick I used to get more bugs out of it more quickly. projectzero.google/2026/03/mutati…

Jackalope and Tinyinst have been working on arm64 macs for a while, but now you should also be able to run against arm64e binaries (i.e. binaries that ship with the os) with some modification to the system. For details, see github.com/googleprojectz…

In the final part of his blog series, @tiraniddo tells the story of how a bug was introduced into a Windows API. Code re-writes can improve security, but it’s important not to forget the security properties the code needs to enforce in the process. projectzero.google/2026/02/gphfh-…

How a single feature was responsible for 5 Windows Administrator Protection bypasses, in a new Project Zero blog post by @tiraniddo

Part 2 of @tiraniddo’s Windows Administrator Protection journey is here! projectzero.google/2026/02/window…