Project Zero is hiring!
Please share with anyone you think would be great for the role.
Remote
Natalie Silvanovich
@natashenka@infosec.exchange
mastodon 4.8.0-alpha.3+glitchTamagotchi hacker. Google Project Zero. she/her
1133 Followers
129 Following
32 Posts
Joined December 14, 2022
Weekend project
For all the uncertainty they cause, LLMs are pretty terrible at creating slides of question marks doing the conga
The passage of time is relentless
What if Python smelled the flowers? Read a book? Did anything but complain about consistent use of tabs and spaces?
Seth Jenkins updated our 0-click exploit chain to work on a Pixel 10 with an eye-popping driver bug!
We’ll be presenting this work Saturday @offensive_con@bird.makeup
You are the manager of a vulnerability research team. You are easily distracted and often late for meetings. You forget important emails.
New variation on an old theme: reporting a low severity bug because AI *fixates* on it to the exclusion of other bugs
Replying to
Remarkably, iOS also integrates the UDC in a 1-click context, but this bug is not exploitable, because the codec is compiled with -fbounds-safety, which inserted bounds checking instructions, making the bug unreachable.
When you join the Stonecutters, you get the real H264 conformance test vectors, that really test all the features
Replying to
The first bug in the chain is CVE-2025-54957, a memory corruption bug in the Dolby Unified Decoder, an audio codec integrated by most Android devices’ OEMs. It is 0-click because incoming SMS and RCS audio messages are automatically transcribed by the system.
Some of us don’t snitch, alright?
https://www.calparks.org/press/californians-urged-observe-and-report-monarch-butterfly-sightings
Big changes to Android and Chrome VRP:
- focus on high-impact, reproducible bugs with low/no reward for lower impact
- big prizes for full chains with some annual limits
- PoCs required
It’s the end of an era, but the start of a new one.
https://bughunters.google.com/blog/evolving-the-android-chrome-vrps-for-the-ai-era
Replying to
IMO, the biggest takeaway from this research is the huge promise shown by memory mitigations, both hardware and software, in protecting users against 0-days.
Ivan Fratric shares some tips and tricks for grammar fuzzing
https://projectzero.google/2026/03/mutational-grammar-fuzzing.html
Just put a reminder in my calendar for November 1, 2026 to check whether we still have bugs
Replying to
IMO, the biggest takeaway from this research is the huge promise shown by memory mitigations, both hardware and software, in protecting users against 0-days.
And the Owl said, “If you want to find the maintainer, go to the north side of the pond when the moon is out. Turn yourself around three times, then look into the water to see them.”
Our intrepid 20%-er @dillonfranke@infosec.exchange exploited a vulnerability in CoreAudio. See his process for gaining privilege escalation on a Mac:
Replying to
The second bug, CVE-2025-36934, is a driver UaF which only affects the Pixel 9, but Project Zero has found many other bugs with similar impact affecting other devices over the past couple years.
Replying to
Replying to
Attack surface reduction is also important— the UDC is largely used by commercial media like TV shows, most devices don’t even have an encoder.
Does it really need to be 0-click?
Replying to
Supply-chain issues also played a role: both vulnerabilities were patched very slowly, due to a variety of factors including bug prioritization, licensing and communication between vendors.
Amazing work by Meta implementing fast and robust WebRTC updates!
“We can’t push updates because …” can often be solved with investment and innovative engineering
There’s ‘shrinkwrap’ on this Tamagotchi … sticker
There’s a little piece of my heart that beats just for Spanify
https://groups.google.com/a/chromium.org/g/chromium-dev/c/iEy69ygz-rs
I’ve been Palling and Malling for so long that even my Momma thinks that my mind is gone