Respect 🫡
A lot of speculation on if KVM bugs have gotten cheaper, and why id do it for 50k instead of a milly. I wasn't born yesterday. I know I couldve sold it for waayy more. I didnt want to. I did it for the love of the game. I wanted to know if I could do it, and now we know i can. Maybe I am a big dreamer?
Lan Vu retweeted
Very powerful bug. In the past, we also submitted few one-shot to Chrome GPU via ANGLE ( but before 250k era 🥲).
This report may include the trick for escaping from the GPU to the CPU ( but i guess too easy for AI atm )
Looking forward the details when the bug is de-restricted.
Cứ khóc đi khóc đi, đừng ngại ngùng 🤧
The released firefox 150.0.3 today has killed our renderer exploit component, since only 1 day left we have no choice but withdrawal our entry.Kudos to our teammate @trichimtrich , @lanleft_ and @wiz1340 for their hard works that created 2 fullchains work flawlessly from firefox 147-150.0.2 ( 4m+ alive) but was being killed one week and 1 day before the event
Good luck for the rest of participants!
And thanks everyone for wishing us luck 🙏
Like usual, we will share writeup in future when the affected version is irrelevant, Cheers!
Lan Vu retweeted
We’ve been through all kinds of situations: exploits failing, vendors turning off services during demos, patches being released the night before a demo, and more but we happily accepted and continue to play.
And if you don’t participate in the game, who cares about your opinion?
Lan Vu retweeted
Firefox x Mythos fixed 423 bugs in April. They released stable 150.0.2!
youtu.be/exkq427zKRU?si=VN6H… via @YouTube
Lan Vu retweeted
Despite 271 bugs massacred by Anthropic, our renderer rce and sbx escape alive and well ready unless there is sudden patch before p2o ( mean we dont have enough time for prepare new one ) - wish us luck!
blog.mozilla.org/en/privacy-…
Lan Vu retweeted
Have Anthropic killed all the Firefish?
0c10b84aa1e72c46319c9a6b4dff5801 : exploit_browser.html just in case patched before p2o 😂
Check out my latest blog post. I hope you all enjoy it
👉👈
qriousec.github.io/post/cve-…
Lan Vu retweeted
Technical details on exploiting Firefox 0day we found last year by AI-assisted fuzzing.
by @lanleft_
qriousec.github.io/post/cve-…
Lan Vu retweeted
Not a single LLM can correctly explain the root cause even given the crash poc of this bug, let alone talk about how to write the exploit code. Kudo @lanleft_ for her great works!
We may publish writeup when it no longer hot.
Lan Vu retweeted
Last month, I gave a talk at @POC_Crew about ATLANTIS and the tech behind our #AIxCC win.
We dove into competition details, using LLMs for deep bug discovery, and what's next for AI in security.
github.com/pr0cf5/talks/blob…
Lan Vu retweeted
A quick review theses Chrome libAngle issues found by Big Sleep likely from fuzzer output more than AI reasoning, 1 or 2 issues even not exploitable because of libc++ mitigation enabled by default in Chrome.
issuetracker.google.com/issu…
The fuzzer still producing many crashes:
issues.chromium.org/issues?q…
Can not get a cve from this vulnerability, it’s quite sad 😞
By the way, I’d like to give a huge thanks to my mentor @__suto 😊
Check out our newest blog about how we took advantage of a WebGPU feature to turn an integer underflow bug into an arbitrary read in Chrome’s WebGPU. This bug was fixed by Google long ago, but our ticket is still restricted.
qriousec.github.io/post/oob-…
by @lanleft_ + @__suto
Lan Vu retweeted
If you like Chrome IPC shenanigans like this, you might also enjoy my talk from black hat 25: youtu.be/qhhJCLy0YBA?si=qLz2…
Whoah... $250000
(CVE-2025-4609, similar to CVE-2025-2783/412578726)[412578726][Mojo][IpczDriver]ipcz bug -> renderer duplicate browser process handle -> escape sbx is now open with PoC & exploit(success rate is nearly 70%-80%)
issues.chromium.org/issues/4…
issues.chromium.org/issues/4…
Lan Vu retweeted
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectzero…
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
