PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-10891] Patch gap to mobile renderer RCE: pwning Samsung Internet’s V8 on the Galaxy S25

osec.io | research | CVE-2025-10891 | #rce | #xss | #mobile-security | #v8 | #n-day | #samsung-internet
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec exploits a six-month-old V8 (CVE-2025-10891) in Samsung Internet on the Galaxy S25, achieving renderer RCE and universal XSS via the n-day patch gap.
CVE
CVE-2025-10891
Published
Collected

Related coverage

research · theori.io
A Deep Dive into V8 Sandbox Escape Technique Used in In-The-Wild Exploit
How Theori escaped the V8 sandbox by abusing a raw pointer in the WasmIndirectFunctionTable object to gain arbitrary write and code execution, plus patch analysis of related sandboxification commits.
research · blog.trailofbits.com
A deep dive into Linux’s new mseal syscall
A deep dive into Linux 6.10's mseal syscall, explaining how memory sealing blocks runtime tampering with VMA permissions and unmapping-based data-only exploits, inspired by Chrome's V8 CFI work.
research · swarm.ptsecurity.com
Creating a Ghidra processor module in SLEIGH using V8 bytecode as an example
How PT SWARM built a Ghidra processor module in SLEIGH for V8 bytecode, gaining readable disassembly and a C-like decompiler for Node.js bytecode — covering the constant pool, p-code injections, analyzers and loaders that make the module work.
research · swarm.ptsecurity.com
How we bypassed bytenode and decompiled Node.js bytecode in Ghidra
Part one of the ghidra_nodejs series: the V8 bytecode format and the bytenode scheme used to ship serialized .jsc binaries, and how the plugin parses, disassembles and decompiles them so otherwise opaque server-side JavaScript can be audited for vulnerabilities.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
Back