A Tale of Two Exploits
Summary: Project Zero's Natalie Silvanovich reported CVE-2015-0336, a type confusion bug in Flash's ActionScript 2 NetConnection class caused by a faulty type check that lets a native function object pass as a NetConnection. Adobe patched it in March 2015, and less than a week later the bug appeared in two exploit kits in the wild, which she compared against her own proof-of-concept written for Firefox on 32-bit Linux.
What's compelling: The gap between patch and in-the-wild exploitation was under a week, and the bug surfaced in two exploit kits at once - a reminder that for Flash-era flaws, the window between vendor fix and attacker weaponization can be measured in days, not months.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2015-0336CVE-2105-0336
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026