googleprojectzero.blogspot.com
Covers: Vulnerabilities & PatchingZero-Days & ExploitsSupply Chain & AppSecGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityDetection & Response
Google Project Zero researcher Seth Jenkins found that the Linux kernel's linear mapping on arm64 is no longer randomized, so the physical-to-virtual calculation is static, and that Pixel bootloaders decompress the kernel at the same physical address...
Between July 2024 and February 2025, six suspicious DNG image files were uploaded to VirusTotal and, following a lead from Meta, came to Google Threat Intelligence Group, which found they targeted the Quram image parsing library used on Samsung devices....
Google Project Zero's Mark Seaborn, with Thomas Dullien, built two working privilege escalation exploits from the DRAM rowhammer bug, in which repeatedly accessing a row of memory causes bit flips in adjacent rows. One exploit uses rowhammer-induced bit...
Project Zero's Gal Beniamini published a three-part research series on exploiting Broadcom's Wi-Fi stack in Apple devices, demonstrating remote code execution on an iPhone 7 running iOS 10.2 and ultimately gaining complete control over the iOS kernel...
Google Project Zero researcher Tavis Ormandy reported dozens of vulnerabilities in Kaspersky Antivirus, including a stack buffer overflow in its Thinstall container unpacker that he exploited to run code as NT AUTHORITY\SYSTEM on versions 15 and 16 under...
Project Zero's Natalie Silvanovich detailed CVE-2015-3077, a type confusion bug in Adobe Flash's Button and MovieClip filter setters that lets any filter type be confused with any other by overwriting the constructor used to initialize a filter object....
Google Project Zero's James Forshaw described a technique using shadow object directories, introduced in Windows 8, to recover symbolic link capability inside sandboxes and exploit file planting or TOCTOU attacks. He used it against CVE-2016-3219, a race...
Google Project Zero recorded 58 in-the-wild 0-days detected and disclosed in 2021, the most since it began tracking in mid-2014 and more than double the prior maximum of 28 in 2015, up from 25 in 2020. Project Zero attributes the rise mainly to increased...
Google Project Zero documented an in-the-wild iOS exploit chain targeting iOS 11 through 11.4.1 across nearly 10 months, covering devices from the iPhone 5s through the iPhone X, and it was the first chain Project Zero observed with a separate sandbox...
Google Project Zero built a framework called Naptime that gives LLMs tools to browse code, run Python scripts, and use a debugger, raising CyberSecEval 2 benchmark scores by up to 20x over the original paper. The approach reached 1.00 on the Buffer...
Google Project Zero's Mateusz Jurczyk explains that the five HKEY root keys seen in Regedit are user-mode pseudo-handles with the highest bit set, translated by KernelBase.dll into internal paths before reaching the kernel, which has no awareness of them....
Google Project Zero's sixth Windows Registry installment details the kernel-mode structures behind an active registry hive, centered on the _CMHIVE descriptor, which spans 0x12F8 bytes and contains a _HHIVE structure of 0x600 bytes at offset 0. The post...