Windows Exploitation Techniques: Dangling COM Object Registrations projectzero.google/2026/09/w…

Windows: CrossDevice Dangling COM Registration Incomplete Fix EoP project-zero.issues.chromium…

Testing race conditions with memory access tracing and stack-based delay injection projectzero.google/2026/09/m…

PowerVR: PVRSRV_MEMALLOCFLAG_OS_LINUX_PREFER_CMA PMR allocations with a large page size causes page allocator corruption project-zero.issues.chromium…

Linux: fork() failure path tries to clean up BPF task storage that was never initialized, leading to UAF project-zero.issues.chromium…

aoc: Type Confusion in aoc_unlocked_ioctl_handle_ion_fd project-zero.issues.chromium…

LWIS kernel driver OOB write in lwis_io_buffer_write project-zero.issues.chromium…

fuse: uninitialized folio read via FUSE_NOTIFY_RETRIEVE on !uptodate pages project-zero.issues.chromium…

Linux 7.0: vfs_open_tree(OPEN_TREE_NAMESPACE) accepts regular files, so cwd can be a regular file project-zero.issues.chromium…

Pixel Codec3P VPU driver: lifetime issues with fw_debug_buf project-zero.issues.chromium…

Adobe DNG SDK: heap buffer overflow in DecodeFPDelta due to missing pixel format validation and non-fatal error handling for semantic mask IFDs project-zero.issues.chromium…

Adobe DNG SDK: Heap memory disclosure via uninitialized MCU buffer in Hasselblad 3FR lossless JPEG decode path project-zero.issues.chromium…

Adobe DNG SDK: Heap memory disclosure via LZW-compressed semantic masks rendered through MaskedRGBTables project-zero.issues.chromium…

Adobe DNG SDK: Heap memory disclosure in ReorderSubTileBlocks due to truncated row block count for clipped strips project-zero.issues.chromium…

PowerVR: virtual/physical unit confusion in DevmemIntComputeVirtualIndicesFromLogical() leads to OOB kernel write project-zero.issues.chromium…

PowerVR: _MMU_AllocLevel() error recovery paths leave dangling page table entries project-zero.issues.chromium…

PowerVR: kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference project-zero.issues.chromium…

Pixel GXP: unsafe set_page_dirty() in gcip_iommu_mapping_buffer_flush_sgt() project-zero.issues.chromium…

libheif: Heap-based Buffer Overflow in Uncompressed Image Tiled Decoding project-zero.issues.chromium…

CPIF driver: link_read_gnss_image and link_load_gnss_image lead to kernel OOB read and write from userland project-zero.issues.chromium…