clem1 retweeted
📢 @googlechrome is moving to a 2 week release cycle! More in goo.gle/4r2mmSK
Also, a short history on browser update frequency:
• 2001: MSFT shipped IE6 & didn't release a major update for 5+ YEARS! Safari updated ~annually
• 2010: Chrome commits to 6-week releases & automatic updates. (People called us crazy.)
• 2021: Chrome updates to 4-week releases. (People said it was too fast.)
• 2026: Chrome goes to 2-week releases. (Opinions TBD :)
Release early, release often for fresher features and faster fixes... especially important with AI vuln discovery! 💪
clem1 retweeted
Today we are releasing a pair of reports:
First: a joint release with NSA, FBI, and the allies, on TA488 (Void Blizzard, Laundry Bear) using half-click XSS exploits
clem1 retweeted
We analyzed the Coruna exploit kit and found intriguing code overlaps with Operation Triangulation. Full analysis on our blog: link below.
clem1 retweeted
BREAKING: powerful iPhone hacking tools used by Chinese criminals originated from US defense giant L3 Harris.
The $LHX zero-click exploits went to Russian spies too.
Unbelievable harm to our collective security.
Scoop by @lorenzofb, here's why this matters 1/
clem1 retweeted
A full iOS exploit toolkit, "Coruna," has been found in the wild, hacking iPhones that visited infected websites, used by Russian spies targeting Ukrainians and thieves targeting Chinese crypto holders. And it may have been created for the US government. wired.com/story/coruna-iphon…
clem1 retweeted
Coruna exploit kit is targeting iOS.
Coruna leverages 23 exploits against Apple devices running iOS 13-17.2.1. It is being used for espionage, and by financially motivated actors to steal crypto.
Update your iOS devices, and learn more about this threat: bit.ly/4rbeltc
clem1 retweeted
New Project Zero blogpost series describing a 0-click exploit chain targeting Pixel 9, featuring a Dolby decoder bug spotted by yours truly.
Today, Project Zero released a 0-click exploit chain for the Pixel 9. While it targets the Pixel, the 0-click bug and exploit techniques we used apply to most other Android devices.
projectzero.google/2026/01/p…
clem1 retweeted
⚠️ @RSF_inter has uncovered a previously unknown #spyware tool used by the State Security Committee (KGB) of 🇧🇾Belarus to target, among others, journalists and media workers.
rsf.org/en/exclusive-rsf-unc…
clem1 retweeted
We launched a redesigned Project Zero website today at projectzero.google !
To mark the occasion, we released some older posts that never quite made it out of drafts.
Enjoy!
clem1 retweeted
Adobe DNG SDK: areaSpec overlap miscalculation lead to integer overflow, leading to OOB read/write project-zero.issues.chromium…
clem1 retweeted
This issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 26.
CVE-2025-43529 is a WebKit use-after-free remote code execution flaw that can be exploited by processing maliciously crafted web content. Apple says the flaw was discovered by Google’s Threat Analysis Group.
CVE-2025-14174 is a WebKit memory corruption flaw that could lead to memory corruption.
support.apple.com/en-us/1258…
[N/A][466192044] High CVE-2025-14174: Out of bounds memory access in ANGLE. Reported by Apple Security Engineering and Architecture (SEAR) and Google Threat Analysis Group on 2025-12-05
chromereleases.googleblog.co…
ANGLE and WebGL 2.0 in WebKit
trac.webkit.org/wiki/Anglefo…
clem1 retweeted
An analysis of a recent 0-click exploit targeting Samsung devices:
googleprojectzero.blogspot.c…
clem1 retweeted
🚨 A huge leak exposes the new targets and internal operations of Intellexa, the secretive and murky company behind the notorious Predator spyware.
Introducing #IntellexaLeaks, a joint investigation with partners @insidestory_gr, @haaretzcom & WAV Research Collective 🧵👇
clem1 retweeted
We derestricted a number of vulnerabilities found by Big Sleep in JavaScriptCore today: issuetracker.google.com/issu…
All of them were fixed in the iOS 26.1 (and equivalent) update last month. Definitely some cool bugs in there!
clem1 retweeted
All my recent activity wasn't for nothing...I'm pleased to announce that I'll be speaking at @DistrictCon with @natashenka about a 0-click to kernel exploit chain for the Pixel 9 in January!
clem1 retweeted
Samsung: QuramDng getOverlap miscalculation leads to integer overflow, leading to out-of-bounds read/write project-zero.issues.chromium…
clem1 retweeted
woah...Exploited ITW
(CVE-2025-10585)[445380761][compiler][maglev]Type Confusion
chromium-review.googlesource…
chromium-review.googlesource…
chromereleases.googleblog.co…
Reported by Google TAG
clem1 retweeted
If you've been keeping track on the Big Sleep bug tracker at goo.gle/bigsleep you might have noticed it lists more bugs now compared to last week. Including a "High impact issue in V8" :)
clem1 retweeted
Exploited ITW
(CVE-2025-6558)[427162086]Incorrect validation of untrusted input(transform feedback buffer modification)
chromium-review.googlesource…
chromereleases.googleblog.co…
Reported by Clément Lecigne(@_clem1) and Vlad Stolyarov(@vladhiewsha)