The Curious Engineer

All blogs / Security

Project Zero

projectzero.google

Make zeroday hard

SecurityWindows internalsReverse engineering

’15’20’25
Posts
257 from 1 Jul 2014 to 27 Oct 2026
Posting
monthly (18 in the last year)
Kind
company blog
Feed
https://projectzero.google/feed.xml

2026 13

  1. Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines
  2. How to fix a bug in a fix
  3. Windows Exploitation Techniques: Dangling COM Object Registrations
  4. Testing race conditions with memory access tracing and stack-based delay injection
  5. A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens
  6. On the Effectiveness of Mutational Grammar Fuzzing
  7. A Deep Dive into the GetProcessHandleFromHwnd API
  8. Bypassing Administrator Protection by Abusing UI Access
  9. Breaking the Sound Barrier, Part II: Exploiting CVE-2024-54529
  10. Bypassing Windows Administrator Protection
  11. A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?
  12. A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave
  13. A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby

2025 15

  1. Welcome to the new Project Zero Blog
  2. Thinking Outside The Box [dusted off draft from 2017]
  3. Windows Exploitation Techniques: Winning Race Conditions with Path Lookups
  4. A look at an Android ITW DNG exploit
  5. Defeating KASLR by Doing Nothing at All
  6. Pointer leaks through pointer-keyed data structures
  7. From Chrome renderer code exec to kernel with MSG_OOB
  8. Policy and Disclosure: 2025 Edition
  9. The Windows Registry Adventure #8: Practical exploitation of hive memory corruption
  10. The Windows Registry Adventure #7: Attack surface analysis
  11. Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages
  12. The Windows Registry Adventure #6: Kernel-mode objects
  13. Blasting Past Webp
  14. Windows Exploitation Tricks: Trapping Virtual Memory Access (2025 Update)
  15. Windows Bug Class: Accessing Trapped COM Objects with IDispatch

2024 12

  1. The Windows Registry Adventure #5: The regf file format
  2. The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit
  3. Windows Tooling Updates: OleView.NET
  4. Simple macOS kernel extension fuzzing in userspace with IDA and TinyInst
  5. From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code
  6. The Windows Registry Adventure #4: Hives and the registry layout
  7. Effective Fuzzing: A Dav1d Case Study
  8. The Windows Registry Adventure #3: Learning resources
  9. Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models
  10. Driving forward in Android drivers
  11. The Windows Registry Adventure #2: A brief history of the feature
  12. The Windows Registry Adventure #1: Introduction and research results

2023 11

  1. First handset with MTE on the market
  2. An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit
  3. Analyzing a Modern In-the-wild Android Exploit
  4. Summary: MTE As Implemented
  5. MTE As Implemented, Part 3: The Kernel
  6. MTE As Implemented, Part 2: Mitigation Case Studies
  7. MTE As Implemented, Part 1: Implementation Testing
  8. Release of a Technical Report into Intel Trust Domain Extensions
  9. Multiple Internet to Baseband Remote Code Execution Vulnerabilities in Exynos Modems
  10. Exploiting null-dereferences in the Linux kernel
  11. DER Entitlements: The (Brief) Return of the Psychic Paper

2022 17

  1. Exploiting CVE-2022-42703 - Bringing back the stack attack
  2. Mind the Gap
  3. A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain
  4. Gregor Samsa: Exploiting Java's XML Signature Verification
  5. RC4 Is Still Considered Harmful
  6. The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)
  7. 2022 0-day In-the-Wild Exploitation…so far
  8. The curious tale of a fake Carrier.app
  9. An Autopsy on a Zombie In-the-Wild 0-day
  10. Release of Technical Report into the AMD Security Processor
  11. The More You Know, The More You Know You Don’t Know
  12. CVE-2021-1782, an iOS in-the-wild vulnerability in vouchers
  13. CVE-2021-30737, @xerub's 2021 iOS ASN.1 Vulnerability
  14. FORCEDENTRY: Sandbox Escape
  15. Racing against the clock -- hitting a tiny kernel race window
  16. A walk through Project Zero metrics
  17. Zooming in on Zero-click Exploits

2021 24

  1. A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
  2. This shouldn't have happened: A vulnerability postmortem
  3. Windows Exploitation Tricks: Relaying DCOM Authentication
  4. Using Kerberos for Authentication Relay Attacks
  5. How a simple Linux kernel memory corruption bug can lead to complete system compromise
  6. Fuzzing Closed-Source JavaScript Engines with Coverage Feedback
  7. Understanding Network Access in Windows AppContainers
  8. An EPYC escape: Case-study of a KVM breakout
  9. Fuzzing iOS code on macOS at native speed
  10. Designing sockfuzzer, a network syscall fuzzer for XNU
  11. Policy and Disclosure: 2021 Edition
  12. Who Contains the Containers?
  13. In-the-Wild Series: October 2020 0-day discovery
  14. Déjà vu-lnerability
  15. A Look at iMessage in iOS 14
  16. Windows Exploitation Tricks: Trapping Virtual Memory Access
  17. The State of State Machines
  18. Hunting for Bugs in Windows Mini-Filter Drivers
  19. Introducing the In-the-Wild Series
  20. In-the-Wild Series: Windows Exploits
  21. In-the-Wild Series: Chrome Infinity Bug
  22. In-the-Wild Series: Chrome Exploits
  23. In-the-Wild Series: Android Post-Exploitation
  24. In-the-Wild Series: Android Exploits

2020 36

  1. An iOS hacker tries Android
  2. An iOS zero-click radio proximity exploit odyssey
  3. Oops, I missed it again!
  4. Enter the Vault: Authentication Issues in HashiCorp Vault
  5. Announcing the Fuzzilli Research Grant Program
  6. Attacking the Qualcomm Adreno GPU
  7. JITSploitation II: Getting Read/Write
  8. JITSploitation III: Subverting Control Flow
  9. JITSploitation I: A JIT Bug
  10. MMS Exploit Part 5: Defeating Android ASLR, Getting RCE
  11. Exploiting Android Messengers with WebRTC: Part 3
  12. Exploiting Android Messengers with WebRTC: Part 2
  13. MMS Exploit Part 4: MMS Primer, Completing the ASLR Oracle
  14. Exploiting Android Messengers with WebRTC: Part 1
  15. The core of Apple is PPL: Breaking the XNU kernel's kernel
  16. One Byte to rule them all
  17. Root Cause Analyses for 0-day In-the-Wild Exploits
  18. Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019
  19. MMS Exploit Part 3: Constructing the Memory Corruption Primitives
  20. MMS Exploit Part 2: Effective Fuzzing of the Qmage Codec
  21. MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface
  22. How to unc0ver a 0-day in 4 hours or less
  23. FF Sandbox Escape (CVE-2020-12388)
  24. A survey of recent iOS kernel exploits
  25. Fuzzing ImageIO
  26. You Won't Believe what this One Line Change Did to the Chrome Sandbox
  27. TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln
  28. Escaping the Chrome Sandbox with RIDL
  29. Mitigations are attack surface, too
  30. A day^W^W Several months in the life of Project Zero - Part 2: The Chrome exploit of suffering
  31. A day^W^W Several months in the life of Project Zero - Part 1: The Chrome bug of suffering
  32. Part II: Returning to Adobe Reader symbols on macOS
  33. Remote iPhone Exploitation Part 3: From Memory Corruption to JavaScript and Back -- Gaining Code Execution
  34. Remote iPhone Exploitation Part 2: Bringing Light into the Darkness -- a Remote ASLR Bypass
  35. Remote iPhone Exploitation Part 1: Poking Memory via iMessage and CVE-2019-8641
  36. Policy and Disclosure: 2020 Edition

2019 27

  1. Calling Local Windows RPC Servers from .NET
  2. SockPuppet: A Walkthrough of a Kernel Exploit for iOS 12.4
  3. Bad Binder: Android In-The-Wild Exploit
  4. KTRW: The journey to build a debuggable iPhone
  5. The story of Adobe Reader symbols
  6. Windows‌ ‌Exploitation‌ ‌Tricks:‌ ‌Spoofing‌ ‌Named‌ ‌Pipe‌ ‌Client‌ ‌PID‌
  7. JSC Exploits
  8. In-the-wild iOS Exploit Chain 5
  9. In-the-wild iOS Exploit Chain 4
  10. In-the-wild iOS Exploit Chain 3
  11. In-the-wild iOS Exploit Chain 2
  12. In-the-wild iOS Exploit Chain 1
  13. Implant Teardown
  14. A very deep dive into iOS Exploit chains found in the wild
  15. The Many Possibilities of CVE-2019-8646
  16. Down the Rabbit-Hole...
  17. The Fully Remote Attack Surface of the iPhone
  18. Trashing the Flow of Data
  19. Windows Exploitation Tricks: Abusing the User-Mode Debugger
  20. Virtually Unlimited Memory: Escaping the Chrome Sandbox
  21. Splitting atoms in XNU
  22. Windows Kernel Logic Bug Class: Access Mode Mismatch in IO Manager
  23. Android Messaging: A Few Bugs Short of a Chain
  24. The Curious Case of Convexity Confusion
  25. Examining Pointer Authentication on the iPhone XS
  26. voucher_swap: Exploiting MIG reference counting in iOS 12
  27. Taking a page from the kernel's book: A TLB issue in mremap()

2018 22

  1. On VBScript
  2. Searching statically-linked vulnerable library functions in executable code
  3. Adventures in Video Conferencing Part 5: Where Do We Go from Here?
  4. Adventures in Video Conferencing Part 4: What Didn't Work Out with WhatsApp
  5. Adventures in Video Conferencing Part 3: The Even Wilder World of WhatsApp
  6. Adventures in Video Conferencing Part 2: Fun with FaceTime
  7. Adventures in Video Conferencing Part 1: The Wild World of WebRTC
  8. Injecting Code into Windows Protected Processes using COM - Part 2
  9. Heap Feng Shader: Exploiting SwiftShader in Chrome
  10. Deja-XNU
  11. Injecting Code into Windows Protected Processes using COM - Part 1
  12. 365 Days Later: Finding and Exploiting Safari Bugs using Publicly Available Tools
  13. A cache invalidation bug in Linux memory management
  14. OATmeal on the Universal Cereal Bus: Exploiting Android phones over USB
  15. The Problems and Promise of WebAssembly
  16. Windows Exploitation Tricks: Exploiting Arbitrary Object Directory Creation for Local Elevation of Privilege
  17. Adventures in vulnerability reporting
  18. Drawing Outside the Box: Precision Issues in Graphic Libraries
  19. Detecting Kernel Memory Disclosure – Whitepaper
  20. Bypassing Mitigations by Attacking JIT Server in Microsoft Edge
  21. Windows Exploitation Tricks: Exploiting Arbitrary File Writes for Local Elevation of Privilege
  22. Reading privileged memory with a side-channel

2017 19

  1. aPAColypse now: Exploiting Windows 10 in a Local Network with WPAD/PAC and JScript
  2. Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices
  3. Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs
  4. Over The Air - Vol. 2, Pt. 2: Exploiting The Wi-Fi Stack on Apple Devices
  5. Over The Air - Vol. 2, Pt. 1: Exploiting The Wi-Fi Stack on Apple Devices
  6. The Great DOM Fuzz-off of 2017
  7. Bypassing VirtualBox Process Hardening on Windows
  8. Windows Exploitation Tricks: Arbitrary Directory Creation to Arbitrary File Read
  9. Trust Issues: Exploiting TrustZone TEEs
  10. Exploiting the Linux kernel via packet sockets
  11. Exploiting .NET Managed DCOM
  12. Exception-oriented exploitation on iOS
  13. Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 2)
  14. Notes on Windows Uniscribe Fuzzing
  15. Pandavirtualization: Exploiting the Xen hypervisor
  16. Over The Air: Exploiting Broadcom’s Wi-Fi Stack (Part 1)
  17. Project Zero Prize Conclusion
  18. Attacking the Windows NVIDIA Driver
  19. Lifting the (Hyper) Visor: Bypassing Samsung’s Real-Time Kernel Protection

2016 17

  1. Chrome OS exploit: one byte overflow and symlinks
  2. BitUnmap: Attacking Android Ashmem
  3. Breaking the Chain
  4. task_t considered harmful
  5. Announcing the Project Zero Prize
  6. Return to libstagefright: exploiting libutils on Android
  7. A Shadow of our Former Self
  8. A year of Windows kernel font fuzzing #2: the techniques
  9. How to Compromise the Enterprise Endpoint
  10. A year of Windows kernel font fuzzing #1: the results
  11. Exploiting Recursion in the Linux Kernel
  12. Life After the Isolated Heap
  13. Race you to the kernel!
  14. Exploiting a Leaked Thread Handle
  15. The Definitive Guide on Win32 to NT Path Conversion
  16. Racing MIDI messages in Chrome
  17. Raising the Dead

2015 33

  1. FireEye Exploitation: Project Zero’s Vulnerability of the Beast
  2. Between a Rock and a Hard Link
  3. Windows Sandbox Attack Surface Analysis
  4. Hack The Galaxy: Hunting Bugs in the Samsung Galaxy S6 Edge
  5. Windows Drivers are True’ly Tricky
  6. Revisiting Apple IPC: (1) Distributed Objects
  7. Kaspersky: Mo Unpackers, Mo Problems.
  8. Stagefrightened?
  9. Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure
  10. Windows 10^H^H Symbolic Link Mitigations
  11. One font vulnerability to rule them all #4: Windows 8.1 64-bit sandbox escape exploitation
  12. Three bypasses and a fix for one of Flash's Vector.<*> mitigations
  13. Attacking ECMAScript Engines with Redefinition
  14. One font vulnerability to rule them all #3: Windows 8.1 32-bit sandbox escape exploitation
  15. One font vulnerability to rule them all #2: Adobe Reader RCE exploitation
  16. One font vulnerability to rule them all #1: Introducing the BLEND vulnerability
  17. One Perfect Bug: Exploiting Type Confusion in Flash
  18. Significant Flash exploit mitigations are live in v18.0.0.209
  19. From inter to intra: gaining reliability
  20. When ‘int’ is the new ‘short’
  21. What is a "good" memory corruption vulnerability?
  22. Analysis and Exploitation of an ESET Vulnerability
  23. Owning Internet Printing - A Case Study in Modern Software Exploitation
  24. Dude, where’s my heap?
  25. In-Console-Able
  26. A Tale of Two Exploits
  27. Taming the wild copy: Parallel Thread Corruption
  28. Exploiting the DRAM rowhammer bug to gain kernel privileges
  29. Feedback and data-driven updates to Google’s disclosure policy
  30. (^Exploiting)\s*(CVE-2015-0318)\s*(in)\s*(Flash$)
  31. A Token’s Tale
  32. Exploiting NVMAP to escape the Chrome sandbox - CVE-2014-5332
  33. Finding and exploiting ntpd vulnerabilities

2014 11

  1. Internet Explorer EPM Sandbox Escape CVE-2014-6350
  2. pwn4fun Spring 2014 - Safari - Part II
  3. Project Zero Patch Tuesday roundup, November 2014
  4. Did the “Man With No Name” Feel Insecure?
  5. More Mac OS X and iPhone sandbox escapes and kernel bugs
  6. Exploiting CVE-2014-0556 in Flash
  7. The poisoned NUL byte, 2014 edition
  8. What does a pointer look like, anyway?
  9. Mac OS X and iPhone sandbox escapes
  10. pwn4fun Spring 2014 - Safari - Part I
  11. Announcing Project Zero