Contact: [email protected]
- Racing V8 and Other Reporters This is a quite sad story about a really cool bug I found in Maglev. Unfortunately, someone else reported it before I could. Since I already had a working PoC and spent a lot of time on it,…
- When Sorting Leads To Confusion In this blogpost I will discuss a chrome 0 day I found and reported in early August 2026 (CVE-2026-85046), a v8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this…
- From Regex to RCE In this blogpost I will discuss a chrome 0 day I found and reported in July 2026, CVE-2026-15776, a bug in v8 that leads to UAF on the js heap. I chained this bug with an n-day sandbox…
- A Ghost in Turboshaft’s Store Elimination This is my personal take at the cve CVE-2025-5419, a bug in the store-store elimination phase of the turboshaft compiler that leads to rce.
- Lua.efi Secure Boot you say? Lua running as a uefi application you say?? What about some Secure Boot war crimes??? Challenge: Lua.efi (uiuctf 2025) Oh hello there! This is a write-up for Lua.efi, a UEFI challenge from UIUCTF 2025 that I and…
- Triwizard Maze Challenge: Triwizard Maze (CCIT 2024 Local Finals) TL;DR: Diving into the Triwizard Tournament with a Depth First Search through a folder maze using multiple ROP chains. Hold onto your wands, witches and wizards! 🪄 This Harry Potter-themed challenge,…
- The Wilderness HEY YOU! Tired of the chaos caused by memory mappings landing just about anywhere?😤 Today, we’re turning the tables on ASLR with a WILD cache timing attack! Challenge: The_wilderness (openECSC 2024 round 2) Attack Type: Timing memory accesses…
- Linecrosser Welcome to the thrilling tale of how a seemingly insignificant oversight led me on a wild ride through the world of stack pivoting with mathematical precision. Challenge: Linecrosser (openECSC 2024 round 1) Attack Type: Ret-to-libc, achieved by stack…