Project Zero Bugs

Libjxl: Integer overflow in pixel buffer size calculation may lead to memory corruption project-zero.issues.chromium.org/issues/4653777…

vpu driver mmap allows OOB physical mappings project-zero.issues.chromium.org/issues/4634382…

On the Effectiveness of Mutational Grammar Fuzzing projectzero.google/2026/03/mutati…

Android: shell->system_server LPE via unbounded recursion and missing stack probes project-zero.issues.chromium.org/issues/4658279…

Adobe DNG SDK: multiple integer arithmetic issues in embedded JXL image support project-zero.issues.chromium.org/issues/4633351…

Adobe DNG SDK: missing allocation check leads to an arbitrary memory write in JXL format processing project-zero.issues.chromium.org/issues/4642507…

Adobe DNG SDK: integer overflow in dng_ref_counted_block::Allocate leads to memory corruption on 32-bit platforms project-zero.issues.chromium.org/issues/4679416…

Bypassing Administrator Protection by Abusing UI Access projectzero.google/2026/02/window…

Samsung: libimagecodec.quram.so DNG out-of-bounds read in DoCopyArea16_R32 during the Render phase project-zero.issues.chromium.org/issues/4574014…

Samsung: QuramDng Warp opcodes out-of-bounds read project-zero.issues.chromium.org/issues/4625445…

Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529 projectzero.google/2026/01/sound-…

Bypassing Windows Administrator Protection projectzero.google/2026/26/window…

A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby projectzero.google/2026/01/pixel-…

A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave projectzero.google/2026/01/pixel-…

A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here? projectzero.google/2026/01/pixel-…

Samsung: libimagecodec.quram.so buffer overflow in WINKJ_YcbcrWriteOutput1to1_YUV422_H1V2_toRGBA8888 during JPEG decoding project-zero.issues.chromium.org/issues/4508842…

Samsung: QuramDng FixBadPixelList opcode out-of-bounds read/write project-zero.issues.chromium.org/issues/4482419…

Samsung: QuramDng opcodes ignore PixelType, leading to out-of-bounds read/writes project-zero.issues.chromium.org/issues/4474793…

Adobe DNG SDK: out-of-bounds read in RefBaselineABCDtoRGB during the Render phase project-zero.issues.chromium.org/issues/4574196…

Adobe DNG SDK: out-of-bounds write in dng_resample_weights::Initialize due to invalid floating point arithmetic project-zero.issues.chromium.org/issues/4579878…