Chrome Security gnome. I work on the sandbox and local data protection on Windows. @parityzero.99 on signal. Opinions here are my own!
Joined June 2011
- Tweets2.5K
- Following803
- Followers3.9K
- Likes2.7K
Pinned Tweet
Try out the early alpha of Process Isolation in Chrome 138. chrome://flags/#enable-process-isolation-ui then chrome://settings/system for the switch. Read known issues issues.chromium.org/issues?q… and report bugs! Especially interested in App-Compat bugs.
So I need to code twice as fast...?
📢 @googlechrome is moving to a 2 week release cycle! More in goo.gle/4r2mmSK
Also, a short history on browser update frequency:
• 2001: MSFT shipped IE6 & didn't release a major update for 5+ YEARS! Safari updated ~annually
• 2010: Chrome commits to 6-week releases & automatic updates. (People called us crazy.)
• 2021: Chrome updates to 4-week releases. (People said it was too fast.)
• 2026: Chrome goes to 2-week releases. (Opinions TBD :)
Release early, release often for fresher features and faster fixes... especially important with AI vuln discovery! 💪
Will Harris retweeted
@googlechrome is officially moving to a two-week release cycle starting today with Chrome 153, letting us deliver features and performance improvements faster than ever.
Cutting our release window in half also shrinks the "N-day" patch gap to an absolute minimum. This helps keep everyone protected against evolving threats as automated AI discovery tools generate higher patch volume. More on that here: goo.gle/4r2mmSK
Will Harris retweeted
Our Black Hat talk on the OpenAI-Hugging Face incident is now live on youtube.
This is a watershed moment for the industry. I encourage all defenders to watch, consider how attack dynamics will imminently change, and plan for accelerating defense.
youtube.com/watch?v=87DyyMV0…
Will Harris retweeted
pwn2own has always been a great datapoint for how hard it is to find vulns, what exploit mitigations are working, new exploitation techniques, and now how AI works on offensive security.
this year's pwn2own isn't just interesting because there will be lots of entries with AI+human.
it is also interesting because
a) anthropic burned a ton of tokens on firefox, basically running claude in a loop until it found something for a month, probably exhausting whatever claude can one shot.
b) if someone submits full chain without much use of ai, it tells you one shotting plateaus and these models are bit like fuzzers than seasoned security reseachers.
c) even if they used an llm to find the bug, this tells us scaffolding/harnesss design, prompting, and the operator matters a lot.
Will Harris retweeted
This young man Manchester Madgwick seems to know everything. What a mind. Bravo 👏🏻
#UniversityChallenge
Will Harris retweeted
Great advice from @AnthropicAI on prep for accelerated AI vulnerability discovery, including what to do if you don’t have a dedicated security team, if you’re reporting bugs you found, or are an open source maintainer.
/ht @_decius_ for sending the link
claude.com/blog/preparing-yo…
Will Harris retweeted
The window between vulnerability disclosure and real-world exploitation keeps shrinking.
The Zero Day Clock visualizes how fast attackers are operationalizing new CVEs. What used to take months now often happens in days, or hours.
The future needs to be Secure by Design.
zerodayclock.com
#AppSec #CyberSecurity
Will Harris retweeted
Someone finally made a proper video on the xz backdoor. It’s missing a lot of the story, that I hope gets told someday, but still worth a watch.
Will Harris retweeted
We launched a redesigned Project Zero website today at projectzero.google !
To mark the occasion, we released some older posts that never quite made it out of drafts.
Enjoy!
Can't believe Celebrity Traitors missed the golden chance to have a good game of Carrot in a Box there.
Will Harris retweeted
🔺iPhone models announced today include Memory Integrity Enforcement, the culmination of an unprecedented design and engineering effort that we believe represents the most significant upgrade to memory safety in the history of consumer operating systems. security.apple.com/blog/memo…
That moment when you think you're going to a European policy talk and the speaker is explaining encrypted firmware. #defcon
Infostealers are using UAC bypasses to try and bypass Chrome's App-Bound Encryption so I'm really excited to see Administrator Protection ship and break all these attackers :) 🔥
This Post is from an account that no longer exists. Learn more
Will Harris retweeted
Hey @espn can you please get a sound engineer on the case in Minnesota? The choppy audio is making the #VegasBorn vs. #mnwild game incredibly brutal to watch. #StanleyCupPlayoffs @NHL
Will Harris retweeted
Chrome 136 now has enhanced cookie security 🍪 → goo.gle/3DMf5SS
Changes to remote debugging switches protect your data. Find out how the --remote-debugging-port and --remote-debugging-pipe switches are now being handled.
ALT Changes to remote debugging switches to improve security
