googleprojectzero.blogspot.com
Covers: Vulnerabilities & PatchingZero-Days & ExploitsSupply Chain & AppSecGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityDetection & Response
Project Zero researcher Jann Horn found five exploitable vulnerabilities in the ARM Mali GPU driver between June and July 2022, after a FirstCon22 talk noted that roughly 50% of observed 0-days in the first half of 2022 were variants of previously patched...
An external researcher describes a Chrome OS exploit reported to Chrome VRP in September, built on a one-byte overflow in the c-ares DNS library reached through an HTTP proxy in shill, the network manager that runs as root. The exploit uses WebRTC's TURN...
Google Project Zero's Seth Jenkins published an exploit for CVE-2022-42703, a use-after-free on struct anon_vma in the Linux kernel's memory management subsystem that Jann Horn found and that was fixed on 5 September 2022. The exploit reclaims the freed...
Google's Threat Analysis Group obtained a partial exploit chain for Samsung Exynos devices, dated late 2020, that TAG believes belonged to a commercial surveillance vendor and was likely captured in the testing phase. The chain used three Samsung-specific...
Google Project Zero's Ivan Fratric describes CVE-2022-42855, a flaw in how Apple operating systems checked app entitlements, which were stored as XML and parsed by four different parsers in different places. Because the parsers could disagree on the same...
Google Project Zero researcher James Forshaw found a Windows Kerberos vulnerability (issue 2310) in June 2022 in which RC4 encryption handling allowed authentication as another user if an attacker could interpose on Kerberos traffic to and from the KDC or...
Google Project Zero's Seth Jenkins demonstrated that null-dereference bugs in the Linux kernel, generally dismissed as harmless since mitigations like SMEP, SMAP and mmap_min_addr, can still be exploited: a null-deref in show_smaps_rollup, triggered by...
Google Project Zero reported eighteen 0-day vulnerabilities in Exynos Modems made by Samsung Semiconductor in late 2022 and early 2023, four of which (CVE-2023-24033, CVE-2023-26496, CVE-2023-26497 and CVE-2023-26498) allow Internet-to-baseband remote code...
Google Project Zero and Google Cloud released a report on a security review of Intel's Trust Domain Extensions (TDX), a feature that provides hardware isolation of virtual machine guests at runtime by securing resources such as guest physical memory....
Google Project Zero reviewed pre-production ARM MTE hardware in mid-2022 and concluded that MTE detects memory corruption exploitation at the first dangerous access, an improvement over hardware-assisted CFI approaches that block later stages of...
Google Project Zero's Mark Brand assessed how well ARM's Memory Tagging Extensions (MTE), proposed by ARM in 2018 in the v8.5a architecture, hold up as a mitigation across four usermode contexts: the Chrome renderer, Chrome IPC sandbox escape, Android...
Google Project Zero's Mark Brand published the third part of a series on ARM's Memory Tagging Extensions, examining how MTE-based mitigations hold up in the kernel context after earlier posts covered hardware limitations and user-mode implications. The...
Project Zero tested pre-production ARM v8.5a hardware implementing Memory Tagging Extensions through mid-2022 and early 2023, using manually tagged statically-linked binaries to assess whether MTE can support security mitigations or only debugging. The...
Google's Threat Analysis Group found an in-the-wild exploit chain against Samsung Android devices in December 2022, and Project Zero's analysis details its final stage: CVE-2023-0266, a race condition in the ALSA 32-bit compatibility layer where a 2017...
Google Project Zero's Mark Brand reports that the Pixel 8 and Pixel 8 Pro are the first production handsets allowing ARM Memory Tagging Extensions to be enabled, a feature he had waited for since late 2017. Using adb commands on a stock image, he set MTE...
Google Project Zero's Mateusz Jurczyk audited the Windows Registry over a 20-month period from May 2022 to December 2023, filing 39 bug reports that Microsoft fixed as 44 CVEs, with an average of 81 days from report to fix. A further 20 low- or...
Google Project Zero's Mateusz Jurczyk traces the Windows registry from its 1992 debut in Windows 3.1, where a single 64 KB hive called reg.dat held only OLE/COM and file type registration data, through the regf format introduced with Windows NT 3.1 in...
Google Project Zero researcher Seth Jenkins surveyed kernel drivers reachable from an unprivileged context on three Android devices - the Google Pixel 7 (Tensor), Xiaomi 11T (MediaTek) and Asus ROG 6D (MediaTek) - and found the MediaTek phones exposed...
Google Project Zero's Mateusz Jurczyk published the third post in his Windows registry series, a consolidated list of learning resources gathered during his registry security audit, including Microsoft Learn documentation, forensic research, Raymond Chen's...
While working on a 20% project with Project Zero, Nick Galloway found a signed 32-bit integer overflow in the dav1d AV1 decoder that occurs when multiple decoding threads are used and leads to an out-of-bounds write to memory. Dav1d 1.4.0 patched the flaw,...
Google Project Zero and Google DeepMind's Big Sleep agent found an exploitable stack buffer underflow in SQLite, a widely used open source database engine, and reported it to developers in early October, who fixed it the same day before it appeared in an...
Google Project Zero's Ivan Fratric described a method for fuzzing Apple's AppleAVD kernel extension, which handles much of AV1 format parsing in software on devices from Apple A17 iOS and M3 macOS, by loading the kernel code into userspace via IDA Pro's...
Google Project Zero's James Forshaw released version 1.16 of OleView.NET, a tool for discovering the attack surface of Windows COM and finding vulnerabilities such as privilege escalation and remote code execution, with updates presented at the Microsoft...
Google Project Zero's James Forshaw describes a Windows 11 24H2 change that lets the SMB client specify a destination TCP port from the command line, so that net use \\localhost\c$ /TCPPORT:12345 routes UNC path access through port 12345 instead of the...
Google Project Zero's James Forshaw describes a Windows bug class in which COM objects reachable across process and security boundaries can be abused, citing CVE-2019-0555, where a malicious client queried the old IXMLDOMDocument interface to run an XSLT...
Google Project Zero's Mateusz Jurczyk details the regf format that has encoded Windows registry hives since Windows NT 3.1 through Windows 11, a design that keeps the same representation on disk and in memory rather than reparsing between the two. He notes...
Google Project Zero analyzed kernel panic logs that TAG received from Amnesty International after an in-the-wild exploit, and the logs led to the discovery of 6 vulnerabilities in Qualcomm's adsprpc driver over 2.5 months, one of which TAG reported as...
Google Project Zero's Ian Beer analyzed BLASTPASS PKPass samples obtained in mid-November 2023 with Amnesty International Security Lab, tracing an NSO zero-click iMessage exploit that Citizen Lab linked to two CVEs fixed in Apple's iOS 16.6.1 update on...
Google Project Zero's Mateusz Jurczyk details how hive-based registry memory corruption can be exploited to elevate a regular user from Medium IL to system-level privileges on Windows 11 while bypassing modern mitigations. He notes the registry cell...
Google Project Zero found CVE-2025-38236, a use-after-free in the Linux kernel's MSG_OOB handling for stream-oriented UNIX domain sockets, affecting Linux 6.9 and later; the bug was reachable inside the Chrome renderer sandbox because the sandbox allowed...