Project Zero Bugs

Linux: hugetlb page table sharing races with VMA splitting, leading to page table UAF project-zero.issues.chromium.org/issues/4207157…

Android: dng_sdk DeltaPerRow out-of-bounds read project-zero.issues.chromium.org/issues/4124222…

libxml2: Integer overflow leading to heap-buffer-overflow in xmlRegEpxFromParse project-zero.issues.chromium.org/issues/4324508…

libxslt: heap-use-after-free in xmlFreeID caused by `atype` corruption project-zero.issues.chromium.org/issues/4105693…

libxslt: Type confusion in xmlNode.psvi between stylesheet and source nodes project-zero.issues.chromium.org/issues/4097619…

Double-fetch of root_size in fastrpc_pack_root_sharedpage leads to buffer overflow project-zero.issues.chromium.org/issues/3994630…

MacOS Sandbox Escape via Double Free in coreaudiod/CoreAudio Framework project-zero.issues.chromium.org/issues/4062711…

Linux >=6.13: io_uring: SQE/CQE UAF/OOB read in race between IORING_REGISTER_RESIZE_RINGS and io_uring_show_fdinfo project-zero.issues.chromium.org/issues/4175226…

Webkit: Cross-site CSS rule and redirect URL disclosure project-zero.issues.chromium.org/issues/4081721…

Samsung S24: Out of bounds memset in VC1 Decoder project-zero.issues.chromium.org/issues/3959754…

Samsung S24: Out of bounds write in VC1 Decoder (svc1d_rr_frm) project-zero.issues.chromium.org/issues/3962269…

Samsung S24: Out of bounds read in MP3 Decoder project-zero.issues.chromium.org/issues/3881150…

The Windows Registry Adventure #8: Practical exploitation of hive memory corruption googleprojectzero.blogspot.com/2025/05/the-wi…

The Windows Registry Adventure #7: Attack surface analysis googleprojectzero.blogspot.com/2025/05/the-wi…

cvp: session id leaks kernel pointers due to cryptographically-insecure hashing project-zero.issues.chromium.org/issues/3976959…

Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages googleprojectzero.blogspot.com/2025/05/breaki…

XNU VM_BEHAVIOR_ZERO_WIRED_PAGES behavior allows writing to read-only pages project-zero.issues.chromium.org/issues/3915186…

Firefox: JavaScript can run during XSLTProcessor transform, leading to use-after-free project-zero.issues.chromium.org/issues/3890794…

The Windows Registry Adventure #6: Kernel-mode objects googleprojectzero.blogspot.com/2025/04/the-wi…

Firefox: inconsistent comparator in xslt/txNodeSorter leads to out-of-bounds access project-zero.issues.chromium.org/issues/3928508…