Security @Google; @FluxFingers/@Sauercl0ud; previously V8 Security, Intern {Project Zero, @XI_Research}. Personal account. https://xitter.cf/t.co/w9zosKSHdh on Bluesky.
Switzerland, Germany, USA
Joined May 2014
- Tweets316
- Following738
- Followers1.1K
- Likes1K
Carl Smith retweeted
Agenda for OffensiveCon Tokyo 2026 is live!
Explore the talks and plan your schedule now:
offensivecon.jp/agenda/2026.…
#OffensiveCon #Tokyo
Carl Smith retweeted
#Zer0Con2026 - SPEAKER 🎃
Pumpkin Chang(@u1f383) from DEVCORE - “Modern Android Kernel Exploitation Through a Mali Driver Vulnerability”
For more: zer0con.org
Carl Smith retweeted
#Zer0Con2026 - SPEAKER 🌌
Brendon Tiszka from Google Project Zero - “Researcher’s Guide to the Galaxy: Digging into Samsung 0-click, Android Messengers, DNG, and other image formats”
For more: zer0con.org
Carl Smith retweeted
We derestricted crbug.com/382005099 today which might just be my favorite bug of the last few years: bad interaction between WebAudio changing the CPU's handling of floats and V8 not expecting that. See crbug.com/382005099#comment1… for a PoC exploit. Also affected other browsers
Carl Smith retweeted
I'm pretty excited about this (POE2 in particular)! It's basically what we've been preparing for with the PKEY-based hardware sandboxing prototype for V8 (docs.google.com/document/d/1…)
More HW security goodness from Arm:
community.arm.com/arm-commun…
vMTE (Virtual Memory Tagging) allows to use MTE in a more flexible way, consuming less RAM.
POE2 allows to build efficient in-process sandboxes and isolation. More-or-less improvement over x86 Memory Protection Keys.
Carl Smith retweeted
If you like Chrome IPC shenanigans like this, you might also enjoy my talk from black hat 25: youtu.be/qhhJCLy0YBA?si=qLz2…
Whoah... $250000
(CVE-2025-4609, similar to CVE-2025-2783/412578726)[412578726][Mojo][IpczDriver]ipcz bug -> renderer duplicate browser process handle -> escape sbx is now open with PoC & exploit(success rate is nearly 70%-80%)
issues.chromium.org/issues/4…
issues.chromium.org/issues/4…
Carl Smith retweeted
That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes)
googleprojectzero.blogspot.c…
Carl Smith retweeted
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectzero…
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
Carl Smith retweeted
If you have a machine with PKEY support and recent Linux kernel you can now play around with hardware support for the V8 sandbox. When active, JS + Wasm code has no write permissions outside the sandbox address space. To enable, set `v8_enable_sandbox_hardware_support = true`.
Carl Smith retweeted
I've also updated our V8 Exploit Tracker sheet now: docs.google.com/document/d/1… (see the 2025 tab) :)
Carl Smith retweeted
...and now, introducing Part 6 of @j00ru's work on the Windows Registry:
googleprojectzero.blogspot.c…
📖👀
Part 5 of @j00ru's Windows Registry Adventure is out!
googleprojectzero.blogspot.c…
Incredible depth of knowledge on display, and good to see it shared as a reference with the world ❤️
Carl Smith retweeted
My writeup of the 2023 NSO in-the-wild iOS zero-click BLASTDOOR webp exploit: Blasting Past Webp -
googleprojectzero.blogspot.c…
Carl Smith retweeted
Senior Software Engineer, V8 Bug Detection: google.com/about/careers/app…
Software Engineer II, V8 Bug Detection:
google.com/about/careers/app…
Carl Smith retweeted
I tweeted before about the Apple CoreAudio issues found by Google TAG. Well, the fuzz harness used to find these issues is now included in Jackalope examples, see github.com/googleprojectzero… . Happy fuzzing! :)
Carl Smith retweeted
Congratulations to Carl Smith from v8 Security team and join Blackhat USA review board as guest reviewer. He is willing to share, and an open-minded, hardcore researcher and developer.
@cffsmith
@BlackHatEvents
I’m very excited to announce that we at V8 Security have finally published our first version of Fuzzilli that understands Wasm!
Go check it out at github.com/googleprojectzero….
While we still have a way to go in improving it, we think it shows a promising approach!
Some slides discussing some of this work can be found here:
powerofcommunity.net/poc2024…
