2026-Jan-26
Bypassing Windows Administrator Protection2025-Dec-16
Welcome to the new Project Zero Blog2025-Dec-12
A look at an Android ITW DNG exploit2025-Nov-03
Defeating KASLR by Doing Nothing at All2025-Jul-29
Policy and Disclosure: 2025 Edition2025-Mar-26
Blasting Past Webp2024-Dec-12
Windows Tooling Updates: OleView.NET2024-Nov-01
From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code2024-Oct-03
Effective Fuzzing: A Dav1d Case Study2024-Jun-13
Driving forward in Android drivers2023-Nov-03
First handset with MTE on the market2023-Sep-19
Analyzing a Modern In-the-wild Android Exploit2023-Aug-02
Summary: MTE As Implemented2023-Aug-02
MTE As Implemented, Part 3: The Kernel2023-Jan-19
Exploiting null-dereferences in the Linux kernel2022-Nov-22
Mind the Gap2022-Oct-27
RC4 Is Still Considered Harmful2022-Jun-30
2022 0-day In-the-Wild Exploitation…so far2022-Jun-23
The curious tale of a fake Carrier.app2022-Jun-14
An Autopsy on a Zombie In-the-Wild 0-day2022-Mar-31
FORCEDENTRY: Sandbox Escape2022-Feb-10
A walk through Project Zero metrics2022-Jan-18
Zooming in on Zero-click Exploits2021-Oct-20
Using Kerberos for Authentication Relay Attacks2021-Jun-29
An EPYC escape: Case-study of a KVM breakout2021-May-20
Fuzzing iOS code on macOS at native speed2021-Apr-15
Policy and Disclosure: 2021 Edition2021-Apr-01
Who Contains the Containers?2021-Mar-18
In-the-Wild Series: October 2020 0-day discovery2021-Feb-03
Déjà vu-lnerability2021-Jan-28
A Look at iMessage in iOS 142021-Jan-19
The State of State Machines2021-Jan-14
Hunting for Bugs in Windows Mini-Filter Drivers2021-Jan-12
Introducing the In-the-Wild Series2021-Jan-12
In-the-Wild Series: Windows Exploits2021-Jan-12
In-the-Wild Series: Chrome Infinity Bug2021-Jan-12
In-the-Wild Series: Chrome Exploits2021-Jan-12
In-the-Wild Series: Android Post-Exploitation2021-Jan-12
In-the-Wild Series: Android Exploits2020-Dec-21
An iOS hacker tries Android2020-Nov-13
Oops, I missed it again!2020-Oct-01
Announcing the Fuzzilli Research Grant Program2020-Sep-08
Attacking the Qualcomm Adreno GPU2020-Sep-01
JITSploitation II: Getting Read/Write2020-Sep-01
JITSploitation III: Subverting Control Flow2020-Sep-01
JITSploitation I: A JIT Bug2020-Jul-30
One Byte to rule them all2020-Jul-09
How to unc0ver a 0-day in 4 hours or less2020-Jun-17
FF Sandbox Escape (CVE-2020-12388)2020-Jun-11
A survey of recent iOS kernel exploits2020-Apr-28
Fuzzing ImageIO2020-Apr-02
TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln2020-Feb-15
Escaping the Chrome Sandbox with RIDL2020-Feb-12
Mitigations are attack surface, too2020-Feb-11
A day^W^W Several months in the life of Project Zero - Part 2: The Chrome exploit of suffering2020-Feb-11
A day^W^W Several months in the life of Project Zero - Part 1: The Chrome bug of suffering2020-Jan-09
Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution2020-Jan-09
Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass2020-Jan-07
Policy and Disclosure: 2020 Edition2019-Dec-17
Calling Local Windows RPC Servers from .NET2019-Nov-21
Bad Binder: Android In-The-Wild Exploit2019-Oct-28
KTRW: The journey to build a debuggable iPhone2019-Oct-08
The story of Adobe Reader symbols2019-Aug-29
JSC Exploits2019-Aug-29
In-the-wild iOS Exploit Chain 52019-Aug-29
In-the-wild iOS Exploit Chain 42019-Aug-29
In-the-wild iOS Exploit Chain 32019-Aug-29
In-the-wild iOS Exploit Chain 22019-Aug-29
In-the-wild iOS Exploit Chain 12019-Aug-29
Implant Teardown2019-Aug-22
The Many Possibilities of CVE-2019-86462019-Aug-13
Down the Rabbit-Hole...2019-Aug-07
The Fully Remote Attack Surface of the iPhone2019-May-10
Trashing the Flow of Data2019-Apr-01
Splitting atoms in XNU2019-Mar-07
Android Messaging: A Few Bugs Short of a Chain2019-Feb-05
The Curious Case of Convexity Confusion2018-Dec-19
On VBScript2018-Oct-18
Deja-XNU2018-Aug-16
The Problems and Promise of WebAssembly2018-Aug-14
Windows Exploitation Tricks: Exploiting Arbitrary Object Directory Creation for Local Elevation of Privilege2018-Aug-02
Adventures in vulnerability reporting2018-Jun-21
Detecting Kernel Memory Disclosure – Whitepaper2018-Apr-18
Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege2018-Jan-03
Reading privileged memory with a side-channel2017-Sep-21
The Great DOM Fuzz-off of 20172017-Jul-24
Trust Issues: Exploiting TrustZone TEEs2017-May-10
Exploiting the Linux kernel via packet sockets2017-Apr-28
Exploiting .NET Managed DCOM2017-Apr-18
Exception-oriented exploitation on iOS2017-Apr-10
Notes on Windows Uniscribe Fuzzing2017-Mar-29
Project Zero Prize Conclusion2017-Feb-14
Attacking the Windows NVIDIA Driver2016-Dec-01
BitUnmap: Attacking Android Ashmem2016-Nov-29
Breaking the Chain2016-Oct-25
task_t considered harmful2016-Sep-13
Announcing the Project Zero Prize2016-Aug-16
A Shadow of our Former Self2016-Jun-28
How to Compromise the Enterprise Endpoint2016-Jun-20
Exploiting Recursion in the Linux Kernel2016-Mar-28
Life After the Isolated Heap2016-Mar-22
Race you to the kernel!2016-Mar-21
Exploiting a Leaked Thread Handle2016-Feb-04
Racing MIDI messages in Chrome2016-Jan-12
Raising the Dead2015-Dec-04
Between a Rock and a Hard Link2015-Nov-18
Windows Sandbox Attack Surface Analysis2015-Oct-15
Windows Drivers are True’ly Tricky2015-Sep-28
Revisiting Apple IPC: (1) Distributed Objects2015-Sep-22
Kaspersky: Mo Unpackers, Mo Problems.2015-Sep-16
Stagefrightened?2015-Sep-14
Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure2015-Aug-25
Windows 10^H^H Symbolic Link Mitigations2015-Aug-21
One font vulnerability to rule them all #4: Windows 8.1 64-bit sandbox escape exploitation2015-Aug-17
Attacking ECMAScript Engines with Redefinition2015-Aug-13
One font vulnerability to rule them all #3: Windows 8.1 32-bit sandbox escape exploitation2015-Jul-10
From inter to intra: gaining reliability2015-Jul-07
When ‘int’ is the new ‘short’2015-Jun-15
Dude, where’s my heap?2015-May-04
In-Console-Able2015-Apr-13
A Tale of Two Exploits2015-Mar-19
Taming the wild copy: Parallel Thread Corruption2015-Feb-09
A Token’s Tale2015-Jan-02
Finding and exploiting ntpd vulnerabilities2014-Nov-24
pwn4fun Spring 2014 - Safari - Part II2014-Oct-20
Did the “Man With No Name” Feel Insecure?2014-Sep-23
Exploiting CVE-2014-0556 in Flash2014-Aug-25
The poisoned NUL byte, 2014 edition2014-Aug-21
What does a pointer look like, anyway?2014-Jul-30
Mac OS X and iPhone sandbox escapes2014-Jul-24
pwn4fun Spring 2014 - Safari - Part I2014-Jul-15
Announcing Project Zero