Adventures in vulnerability reporting
Summary: Project Zero's Natalie Silvanovich documented how Samsung's vulnerability reporting process for CVE-2018-10751, a remote memory corruption flaw in OMACP on the Samsung S7 Edge triggerable by a single SMS with no user interaction, required creating an account, agreeing to over twenty separate agreements, and accepting terms giving Samsung control over disclosure before a report could be submitted. She also cited Cloudflare's CloudBleed reporting process, tied to its HackerOne rewards program with a 180-day disclosure deadline versus Project Zero's 90 days, as an example of rewards programs replacing existing reporting channels.
Key Takeaway: A single SMS could trigger memory corruption on an S7 Edge with no user interaction, yet the report was delayed by account creation, Korean-only pages, and mandatory legal terms - and when vendors fold reporting into rewards programs, a 180-day disclosure window can replace a 90-day one while user data is actively leaking.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026