Skip to content
Root Cause Analyses for 0-day In-the-Wild Exploits
projectzero.google | vulnerability | #zero-day | #project-zero | #root-cause-analysis | #in-the-wild
Summary
Our effort on this began in earnest in the last quarter of 2019. Today we are beginning to publish the root cause analyses for 0-days exploited in the wild that we have completed. While we’re publishing some in bulk now to play “catch-up”, in the future we plan to post each one in a timely manner after it’s detected and disclosed. We think publishing technical details in a timely manner is important for transparency and so that the whole of the security community can make informed decisions and actions.
- Published
- Collected
Related coverage
vulnerability ·
projectzero.google
Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019
In May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a more focused effort on analyzing and learning from these exploits. This is another way Project Zero is trying to make zero-day hard. This blog post synthesizes many of our efforts and what we’ve seen over the last year. We provide a review of what we can learn from 0-day exploits detected as used in the wild in 2019. In conjunction with this blog post, we are also publishing another blog post today about our root cause analysis work that informed the conclusions in this Year in Review. We are also releasing 8 root cause analyses that we have done for in-the-wild 0-days from 2019.
vulnerability ·
projectzero.google
TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln
I’m really interested in 0-days exploited in the wild and what we, the security community, can learn about them to make 0-day hard. I explained some of Project Zero’s ideas and goals around in-the-wild 0-days in a November blog post.
vulnerability ·
netspi.com
CVE-2026-0300 Palo Alto Networks PAN-OS Buffer Overflow Overview & Takeaways
CVE-2026-0300 is a pre-auth buffer overflow in the PAN-OS User-ID Authentication Portal giving unauthenticated root RCE on PA-Series and VM-Series firewalls, already exploited in the wild.
research ·
projectzero.google
Analyzing a Modern In-the-wild Android Exploit
An analysis of CVE-2023-0266 as used in a modern in-the-wild Android exploit, dissecting the vulnerability, the exploitation strategy, and defensive lessons learned.
blog ·
projectzero.google
In-the-Wild Series: Android Exploits
.post-body{ul.lst-kix_lw3zh1qbhlji-0{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-1{list-style-type:none}.lst-kix_f28qers2ka94-4>li{counter-increment:lst-ctn-kix_f28qers2ka94-4}ul.lst-kix_lw3zh1qbhlji-6{list-style-type:none}.lst-kix_o1lgec7ujykk-8>li:before{content:"- "}ul.lst-kix_lw3zh1qbhlji-7{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-8{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-2{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-3{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-4{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-5{list-style-type:none}ol.lst-kix_f28qers2ka94-5.start{counter-reset:lst-ctn-kix_f28qers2ka94-5 0}.lst-kix_f28qers2ka94-2>li{counter-increment:lst-ctn-kix_f28qers2ka94-2}.lst-kix_thuqgp6gfs8h-2>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-2}.lst-kix_olvs1jbt89fl-4>li:before{content:"- "}.lst-kix_olvs1jbt89fl-5>li:before{content:"- "}.lst-kix_olvs1jbt89fl-7>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-4>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-4}.lst-kix_olvs1jbt89fl-6>li:before{content:"- "}ol.lst-kix_thuqgp6gfs8h-4.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-4 0}.lst-kix_olvs1jbt89fl-8>li:before{content:"- "}ul.lst-kix_5kmetj22qqvk-7{list-style-type:none}ul.lst-kix_5kmetj22qqvk-6{list-style-type:none}ul.lst-kix_5kmetj22qqvk-5{list-style-type:none}ul.lst-kix_5kmetj22qqvk-4{list-style-type:none}ul.lst-kix_5kmetj22qqvk-3{list-style-type:none}.lst-kix_thuqgp6gfs8h-6>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-6}ul.lst-kix_5kmetj22qqvk-2{list-style-type:none}ul.lst-kix_5kmetj22qqvk-1{list-style-type:none}ul.lst-kix_5kmetj22qqvk-0{list-style-type:none}ol.lst-kix_f28qers2ka94-6.start{counter-reset:lst-ctn-kix_f28qers2ka94-6 0}ol.lst-kix_thuqgp6gfs8h-3.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-3 0}.lst-kix_5kmetj22qqvk-8>li:before{content:"- "}.lst-kix_olvs1jbt89fl-3>li:before{content:"- "}.lst-kix_olvs1jbt89fl-2>li:before{content:"- "}.lst-kix_5kmetj22qqvk-0>li:before{content:"- "}.lst-kix_olvs1jbt89fl-1>li:before{content:"- "}.lst-kix_f28qers2ka94-8>li{counter-increment:lst-ctn-kix_f28qers2ka94-8}.lst-kix_5kmetj22qqvk-2>li:before{content:"- "}.lst-kix_5kmetj22qqvk-1>li:before{content:"- "}.lst-kix_olvs1jbt89fl-0>li:before{content:"- "}.lst-kix_o1lgec7ujykk-7>li:before{content:"- "}.lst-kix_o1lgec7ujykk-6>li:before{content:"- "}.lst-kix_5kmetj22qqvk-7>li:before{content:"- "}.lst-kix_o1lgec7ujykk-4>li:before{content:"- "}.lst-kix_o1lgec7ujykk-3>li:before{content:"- "}.lst-kix_o1lgec7ujykk-5>li:before{content:"- "}.lst-kix_5kmetj22qqvk-6>li:before{content:"- "}ol.lst-kix_f28qers2ka94-0.start{counter-reset:lst-ctn-kix_f28qers2ka94-0 0}.lst-kix_5kmetj22qqvk-5>li:before{content:"- "}.lst-kix_o1lgec7ujykk-0>li:before{content:"- "}.lst-kix_o1lgec7ujykk-1>li:before{content:"- "}.lst-kix_5kmetj22qqvk-4>li:before{content:"- "}.lst-kix_o1lgec7ujykk-2>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-0>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-0}.lst-kix_5kmetj22qqvk-3>li:before{content:"- "}ul.lst-kix_5kmetj22qqvk-8{list-style-type:none}.lst-kix_c52otkrerajb-7>li:before{content:"- "}ol.lst-kix_f28qers2ka94-4.start{counter-reset:lst-ctn-kix_f28qers2ka94-4 0}.lst-kix_c52otkrerajb-5>li:before{content:"- "}.lst-kix_tjxel15w0vnb-0>li:before{content:"\0025cf "}.lst-kix_b2z7bfhnik92-1>li:before{content:"- "}ol.lst-kix_thuqgp6gfs8h-5.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-5 0}.lst-kix_f28qers2ka94-1>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-1,lower-latin) ". "}ol.lst-kix_f28qers2ka94-1.start{counter-reset:lst-ctn-kix_f28qers2ka94-1 0}ul.lst-kix_t4et3tnq1pzp-3{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-4{list-style-type:none}.lst-kix_b2z7bfhnik92-5>li:before{content:"- "}ul.lst-kix_t4et3tnq1pzp-1{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-2{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-7{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-8{list-style-type:none}.lst-kix_c52otkrerajb-1>li:before{content:"- "}.lst-kix_b2z7bfhnik92-3>li:before{content:"- "}.lst-kix_b2z7bfhnik92-7>li:before{content:"- "}ul.lst-kix_t4et3tnq1pzp-5{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-6{list-style-type:none}.lst-kix_lw3zh1qbhlji-0>li:before{content:"\0025cf "}ol.lst-kix_thuqgp6gfs8h-8.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-8 0}.lst-kix_c52otkrerajb-3>li:before{content:"- "}ul.lst-kix_t4et3tnq1pzp-0{list-style-type:none}ul.lst-kix_tjxel15w0vnb-1{list-style-type:none}ul.lst-kix_tjxel15w0vnb-2{list-style-type:none}ul.lst-kix_tjxel15w0vnb-3{list-style-type:none}ul.lst-kix_tjxel15w0vnb-4{list-style-type:none}ul.lst-kix_tjxel15w0vnb-0{list-style-type:none}ul.lst-kix_tjxel15w0vnb-5{list-style-type:none}ul.lst-kix_tjxel15w0vnb-6{list-style-type:none}ul.lst-kix_tjxel15w0vnb-7{list-style-type:none}ul.lst-kix_tjxel15w0vnb-8{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-7.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-7 0}ul.lst-kix_b2z7bfhnik92-7{list-style-type:none}ul.lst-kix_b2z7bfhnik92-8{list-style-type:none}ul.lst-kix_b2z7bfhnik92-5{list-style-type:none}ul.lst-kix_b2z7bfhnik92-6{list-style-type:none}ul.lst-kix_b2z7bfhnik92-3{list-style-type:none}ul.lst-kix_b2z7bfhnik92-4{list-style-type:none}ul.lst-kix_b2z7bfhnik92-1{list-style-type:none}ul.lst-kix_b2z7bfhnik92-2{list-style-type:none}ul.lst-kix_b2z7bfhnik92-0{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-8{list-style-type:none}ul.lst-kix_c52otkrerajb-0{list-style-type:none}ul.lst-kix_o1lgec7ujykk-5{list-style-type:none}ul.lst-kix_o1lgec7ujykk-6{list-style-type:none}ul.lst-kix_o1lgec7ujykk-7{list-style-type:none}ul.lst-kix_o1lgec7ujykk-8{list-style-type:none}ul.lst-kix_o1lgec7ujykk-1{list-style-type:none}ol.lst-kix_f28qers2ka94-2.start{counter-reset:lst-ctn-kix_f28qers2ka94-2 0}ul.lst-kix_o1lgec7ujykk-2{list-style-type:none}ul.lst-kix_o1lgec7ujykk-3{list-style-type:none}ul.lst-kix_o1lgec7ujykk-4{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-0{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-1{list-style-type:none}.lst-kix_thuqgp6gfs8h-5>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-5}ol.lst-kix_thuqgp6gfs8h-2{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-3{list-style-type:none}.lst-kix_7gtwvv8lds0h-2>li:before{content:"- "}ul.lst-kix_o1lgec7ujykk-0{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-4{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-5{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-6{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-7{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-6.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-6 0}.lst-kix_7gtwvv8lds0h-4>li:before{content:"- "}.lst-kix_7gtwvv8lds0h-6>li:before{content:"- "}.lst-kix_f28qers2ka94-7>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-7,lower-latin) ". "}ul.lst-kix_c52otkrerajb-8{list-style-type:none}.lst-kix_tjxel15w0vnb-8>li:before{content:"\0025a0 "}ul.lst-kix_c52otkrerajb-7{list-style-type:none}ul.lst-kix_c52otkrerajb-6{list-style-type:none}ul.lst-kix_c52otkrerajb-5{list-style-type:none}.lst-kix_7gtwvv8lds0h-8>li:before{content:"- "}ul.lst-kix_c52otkrerajb-4{list-style-type:none}ul.lst-kix_olvs1jbt89fl-6{list-style-type:none}ul.lst-kix_c52otkrerajb-3{list-style-type:none}ul.lst-kix_olvs1jbt89fl-5{list-style-type:none}ul.lst-kix_c52otkrerajb-2{list-style-type:none}ul.lst-kix_olvs1jbt89fl-8{list-style-type:none}ul.lst-kix_c52otkrerajb-1{list-style-type:none}ul.lst-kix_olvs1jbt89fl-7{list-style-type:none}.lst-kix_tjxel15w0vnb-4>li:before{content:"\0025cb "}.lst-kix_f28qers2ka94-3>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-3,decimal) ". "}ul.lst-kix_olvs1jbt89fl-2{list-style-type:none}.lst-kix_f28qers2ka94-0>li{counter-increment:lst-ctn-kix_f28qers2ka94-0}ul.lst-kix_olvs1jbt89fl-1{list-style-type:none}.lst-kix_f28qers2ka94-6>li{counter-increment:lst-ctn-kix_f28qers2ka94-6}ul.lst-kix_olvs1jbt89fl-4{list-style-type:none}ul.lst-kix_olvs1jbt89fl-3{list-style-type:none}.lst-kix_tjxel15w0vnb-2>li:before{content:"\0025a0 "}.lst-kix_tjxel15w0vnb-6>li:before{content:"\0025cf "}ul.lst-kix_olvs1jbt89fl-0{list-style-type:none}ol.lst-kix_f28qers2ka94-3.start{counter-reset:lst-ctn-kix_f28qers2ka94-3 0}.lst-kix_f28qers2ka94-5>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-5,lower-roman) ". "}.lst-kix_thuqgp6gfs8h-3>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-3}.lst-kix_f28qers2ka94-5>li{counter-increment:lst-ctn-kix_f28qers2ka94-5}ol.lst-kix_f28qers2ka94-6{list-style-type:none}ol.lst-kix_f28qers2ka94-5{list-style-type:none}ol.lst-kix_f28qers2ka94-8{list-style-type:none}ol.lst-kix_f28qers2ka94-7{list-style-type:none}ol.lst-kix_f28qers2ka94-2{list-style-type:none}ol.lst-kix_f28qers2ka94-1{list-style-type:none}ol.lst-kix_f28qers2ka94-4{list-style-type:none}ol.lst-kix_f28qers2ka94-3{list-style-type:none}ol.lst-kix_f28qers2ka94-0{list-style-type:none}.lst-kix_7gtwvv8lds0h-1>li:before{content:"- "}.lst-kix_7gtwvv8lds0h-0>li:before{content:"- "}ol.lst-kix_thuqgp6gfs8h-1.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-1 0}ol.lst-kix_f28qers2ka94-8.start{counter-reset:lst-ctn-kix_f28qers2ka94-8 0}.lst-kix_t4et3tnq1pzp-4>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-0>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-0,decimal) ". "}.lst-kix_thuqgp6gfs8h-1>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-1,lower-latin) ". "}.lst-kix_f38l0ecznhb0-6>li:before{content:"- "}.lst-kix_f38l0ecznhb0-7>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-3>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-5>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-2>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-2,lower-roman) ". "}.lst-kix_thuqgp6gfs8h-3>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-3,decimal) ". "}.lst-kix_t4et3tnq1pzp-0>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-8>li:before{content:"- "}.lst-kix_f28qers2ka94-7>li{counter-increment:lst-ctn-kix_f28qers2ka94-7}.lst-kix_f38l0ecznhb0-3>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-1>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-2>li:before{content:"- "}.lst-kix_f28qers2ka94-1>li{counter-increment:lst-ctn-kix_f28qers2ka94-1}.lst-kix_f38l0ecznhb0-4>li:before{content:"- "}.lst-kix_f38l0ecznhb0-5>li:before{content:"- "}.lst-kix_f38l0ecznhb0-8>li:before{content:"- "}ul.lst-kix_7gtwvv8lds0h-0{list-style-type:none}ul.lst-kix_7gtwvv8lds0h-1{list-style-type:none}.lst-kix_lw3zh1qbhlji-1>li:before{content:"\0025cb "}ul.lst-kix_7gtwvv8lds0h-2{list-style-type:none}.lst-kix_lw3zh1qbhlji-2>li:before{content:"\0025a0 "}ul.lst-kix_7gtwvv8lds0h-7{list-style-type:none}.lst-kix_thuqgp6gfs8h-8>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-8,lower-roman) ". "}ul.lst-kix_7gtwvv8lds0h-8{list-style-type:none}.lst-kix_lw3zh1qbhlji-3>li:before{content:"\0025cf "}.lst-kix_lw3zh1qbhlji-5>li:before{content:"\0025a0 "}ul.lst-kix_7gtwvv8lds0h-3{list-style-type:none}.lst-kix_thuqgp6gfs8h-6>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-6,decimal) ". "}.lst-kix_thuqgp6gfs8h-7>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-7,lower-latin) ". "}ul.lst-kix_7gtwvv8lds0h-4{list-style-type:none}ul.lst-kix_7gtwvv8lds0h-5{list-style-type:none}.lst-kix_lw3zh1qbhlji-4>li:before{content:"\0025cb "}ul.lst-kix_7gtwvv8lds0h-6{list-style-type:none}.lst-kix_thuqgp6gfs8h-4>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-4,lower-latin) ". "}.lst-kix_thuqgp6gfs8h-5>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-5,lower-roman) ". "}.lst-kix_f38l0ecznhb0-2>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-7>li:before{content:"- "}.lst-kix_lw3zh1qbhlji-7>li:before{content:"\0025cb "}.lst-kix_t4et3tnq1pzp-6>li:before{content:"- "}.lst-kix_f38l0ecznhb0-0>li:before{content:"- "}.lst-kix_f38l0ecznhb0-1>li:before{content:"- "}.lst-kix_lw3zh1qbhlji-6>li:before{content:"\0025cf "}.lst-kix_c52otkrerajb-8>li:before{content:"- "}.lst-kix_c52otkrerajb-6>li:before{content:"- "}.lst-kix_b2z7bfhnik92-0>li:before{content:"- "}.lst-kix_lw3zh1qbhlji-8>li:before{content:"\0025a0 "}ol.lst-kix_thuqgp6gfs8h-2.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-2 0}.lst-kix_b2z7bfhnik92-2>li:before{content:"- "}.lst-kix_tjxel15w0vnb-1>li:before{content:"\0025cb "}.lst-kix_f28qers2ka94-0>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-0,decimal) ". "}.lst-kix_c52otkrerajb-0>li:before{content:"- "}.lst-kix_b2z7bfhnik92-6>li:before{content:"- "}ol.lst-kix_f28qers2ka94-7.start{counter-reset:lst-ctn-kix_f28qers2ka94-7 0}.lst-kix_c52otkrerajb-2>li:before{content:"- "}.lst-kix_b2z7bfhnik92-4>li:before{content:"- "}.lst-kix_b2z7bfhnik92-8>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-8>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-8}.lst-kix_c52otkrerajb-4>li:before{content:"- "}ul.lst-kix_f38l0ecznhb0-8{list-style-type:none}ul.lst-kix_f38l0ecznhb0-6{list-style-type:none}ul.lst-kix_f38l0ecznhb0-7{list-style-type:none}ul.lst-kix_f38l0ecznhb0-4{list-style-type:none}ul.lst-kix_f38l0ecznhb0-5{list-style-type:none}ul.lst-kix_f38l0ecznhb0-2{list-style-type:none}ul.lst-kix_f38l0ecznhb0-3{list-style-type:none}ul.lst-kix_f38l0ecznhb0-0{list-style-type:none}ul.lst-kix_f38l0ecznhb0-1{list-style-type:none}.lst-kix_thuqgp6gfs8h-7>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-7}ol.lst-kix_thuqgp6gfs8h-0.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-0 0}.lst-kix_thuqgp6gfs8h-1>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-1}.lst-kix_7gtwvv8lds0h-3>li:before{content:"- "}.lst-kix_7gtwvv8lds0h-5>li:before{content:"- "}.lst-kix_tjxel15w0vnb-7>li:before{content:"\0025cb "}.lst-kix_f28qers2ka94-8>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-8,lower-roman) ". "}.lst-kix_7gtwvv8lds0h-7>li:before{content:"- "}.lst-kix_f28qers2ka94-3>li{counter-increment:lst-ctn-kix_f28qers2ka94-3}.lst-kix_tjxel15w0vnb-3>li:before{content:"\0025cf "}.lst-kix_tjxel15w0vnb-5>li:before{content:"\0025a0 "}.lst-kix_f28qers2ka94-2>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-2,lower-roman) ". "}.lst-kix_f28qers2ka94-6>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-6,decimal) ". "}.lst-kix_f28qers2ka94-4>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-4,lower-latin) ". "}ol{margin:0;padding:0}table td,table th{padding:0}.c16{padding-top:0pt;padding-bottom:0pt;line-height:1.25;orphans:2;widows:2;text-align:left;height:11pt}.c13{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:16pt;font-family:"Arial";font-style:normal}.c2{background-color:#ffffff;padding-top:18pt;padding-bottom:6pt;line-height:1.38;orphans:2;widows:2;text-align:left}.c0{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c5{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c6{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c17{padding-top:0pt;padding-bottom:0pt;line-height:1.25;orphans:2;widows:2;text-align:left}.c7{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c12{color:#000000;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c14{color:#000000;text-decoration:none;vertical-align:baseline;font-size:11pt;font-style:normal}.c18{font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial"}.c9{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c10{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c1{color:inherit;text-decoration:inherit}.c8{font-weight:400;font-family:"Courier New"}.c3{background-color:#ffffff;color:#545454}.c11{background-color:#ffffff;font-style:italic}.c4{font-weight:700}.c15{font-style:italic}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}}This is part 4 of a 6-part series detailing a set of vulnerabilities found by Project Zero being exploited in the wild. To read the other parts of the series, see the introduction post.
research ·
projectzero.google
A very deep dive into iOS Exploit chains found in the wild
Project Zero’s mission is to make 0-day hard. We often work with other companies to find and report security vulnerabilities, with the ultimate goal of advocating for structural security improvements in popular systems to help protect people everywhere.