Writeups
Vulnerability writeups.
Root-cause analysis and proof of concept for vulnerabilities I discovered and disclosed responsibly. Every entry maps to a public record.
Mozilla FirefoxToolkit, Form AutofillTest-only FormAutofill handlers exposed in production
Four test-only message handlers shipped in Firefox let any compromised renderer read, inject, or delete saved autofill data.
Read writeup
CometChatJS SDK 3.0.12Stored XSS in CometChat group messages
A persistent JavaScript payload in group messages executes in the browser of every member who opens the conversation.
Read writeupMozilla FirefoxGraphics, ImageLibUse-after-free in RasterImage surface discard
A cross-thread check-then-AddRef race in image surface discard resurrects a freed RasterImage, a content-process use-after-free reachable from a web page.
Read writeupMozilla FirefoxGraphics, TextUninitialized heap disclosure through a crafted web font
A crafted @font-face leaves an uninitialized-heap gap in the sanitized font; measuring a character leaks process memory two bytes at a time.
Read writeupMozilla FirefoxGraphics, WebRenderFission site-isolation bypass via missing PipelineId namespace check
A compromised content process forges a WebRender PipelineId namespace to hijack another origin's image pipeline, bypassing Fission site isolation.
Read writeup