Tech lead and security researcher at Google Project Zero. Author: Jackalope, TinyInst, WinAFL, Domato. PhD. Tweets are my own. Backup @ifsecure@infosec.exchange
Joined August 2011
- Tweets1.3K
- Following211
- Followers19.1K
- Likes1.4K
Pinned Tweet
The slides for my Black Hat talk "XMPP Stanza Smuggling or How I Hacked Zoom" are now available at blackhat.com/us-22/briefings…
I'm sure nobody will need to deploy an emergency fix anytime soon in this age of ai-written exploits. But maybe read below just in case ;)
All vendors should have a plan for rapid remediation in the case of active exploitation.
Here’s some emergency fix strategies we’ve seen over the years:
projectzero.google/2026/10/e…
Ivan Fratric 💙💛 retweeted
All vendors should have a plan for rapid remediation in the case of active exploitation.
Here’s some emergency fix strategies we’ve seen over the years:
projectzero.google/2026/10/e…
When an elevator closes, but a stairwell remains open
In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”.
But was it really fixed?
Ask @tiraniddo
projectzero.google/2026/09/w…
Ivan Fratric 💙💛 retweeted
In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”.
But was it really fixed?
Ask @tiraniddo
projectzero.google/2026/09/w…
New race condition tooling by @tehjh!
Today, Project Zero is releasing MAccConc, a tool by @tehjh that enables deterministic testing of race conditions on Linux. It can be used for fuzzing, ad-hoc exploration, regression tests and more!
projectzero.google/2026/09/m…
At this year's OffensiveCon, @R00tkitSMM quite correctly pointed out to me that, on Apple devices, MTE can be used to get more reliable crashes while fuzzing. He also pointed out that Jackalope/TinyInst does not support binaries with MTE enabled and crashes. (1/2)
In case you missed it!
Project Zero is hiring!
google.com/about/careers/app…
Please share with anyone you think would be great for the role. DMs are open for questions.
Ivan Fratric 💙💛 retweeted
Project Zero is hiring!
google.com/about/careers/app…
Please share with anyone you think would be great for the role. DMs are open for questions.
Ivan Fratric 💙💛 retweeted
Finally it got published.
We found a working remote Spectre attack against Cloudflare Workers. We already fixed it. No exploitation in the wild. Blog post and paper out now:
cfl.re/4qKdP6V
Ivan Fratric 💙💛 retweeted
My and @natashenka 's talk from OffensiveCon is now available on YouTube! Watch for a tour of a zero-click to root exploit chain across multiple generations of Google Pixel!
youtube.com/watch?v=jpB_b6KG…
Ivan Fratric 💙💛 retweeted
Offensivecon's talks are now available on our YouTube channel!
🔗 buff.ly/g63xgm5
It is true that you can query (e.g. via curl) a server and get a redirect url *if* that redirect url is not user-specific. However the idea of the talk was to leak redirect urls that contain sensitive information (such as the OAath access token in my 1st demo).
Turns out adapting our 0click chain to work on Pixel 10 wasn't that hard... at least if you're into Android drivers as much as @__sethJenkins.
.@__sethJenkins updated our 0-click exploit chain to work on a Pixel 10 with an eye-popping driver bug!
We’ll be presenting this work Saturday @offensive_con
projectzero.google/2026/05/p…
Ivan Fratric 💙💛 retweeted
.@__sethJenkins updated our 0-click exploit chain to work on a Pixel 10 with an eye-popping driver bug!
We’ll be presenting this work Saturday @offensive_con
projectzero.google/2026/05/p…
Ivan Fratric 💙💛 retweeted
The fuzzer that found project-zero.issues.chromium… (and a number of issues prior to that as well) is now open-source: crrev.com/c/7580844
It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!
Ivan Fratric 💙💛 retweeted
Just derestricted a now-fixed kernel bug in Pixel 10. I think this ranks as the most easily exploited kernel bug of all time😬
Thanks to @tehjh for collab'ing on this driver and full credits for noticing this bug in the first 5 minutes of auditing😂
project-zero.issues.chromium…
I wrote a short blogpost on the quirks of grammar fuzzing (and, more generally, structure-aware fuzzing) and a simple trick I used to get more bugs out of it more quickly. projectzero.google/2026/03/m…
Jackalope and Tinyinst have been working on arm64 macs for a while, but now you should also be able to run against arm64e binaries (i.e. binaries that ship with the os) with some modification to the system. For details, see github.com/googleprojectzero…
