How to unc0ver a 0-day in 4 hours or less

Project Zero’s mission is to make 0-day hard. We often work with other companies to find and report security vulnerabilities, with the ultimate goal of advocating for structural security improvements in popular systems to help protect people everywhere.

A Google Project Zero rundown of sandbox escape and privilege escalation bugs in Mac OS X and iOS fixed by Apple in OS X 10.9.5 and iOS 8.

.post-body{ul.lst-kix_68660h7uawx-0{list-style-type:none}ul.lst-kix_68660h7uawx-1{list-style-type:none}ul.lst-kix_68660h7uawx-2{list-style-type:none}ul.lst-kix_68660h7uawx-3{list-style-type:none}ul.lst-kix_68660h7uawx-4{list-style-type:none}ul.lst-kix_68660h7uawx-5{list-style-type:none}ul.lst-kix_68660h7uawx-6{list-style-type:none}.lst-kix_68660h7uawx-7>li:before{content:"\0025cb "}ul.lst-kix_68660h7uawx-7{list-style-type:none}ul.lst-kix_68660h7uawx-8{list-style-type:none}.lst-kix_68660h7uawx-0>li:before{content:"\0025cf "}.lst-kix_68660h7uawx-6>li:before{content:"\0025cf "}.lst-kix_68660h7uawx-8>li:before{content:"\0025a0 "}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}.lst-kix_68660h7uawx-3>li:before{content:"\0025cf "}.lst-kix_68660h7uawx-2>li:before{content:"\0025a0 "}.lst-kix_68660h7uawx-4>li:before{content:"\0025cb "}.lst-kix_68660h7uawx-1>li:before{content:"\0025cb "}.lst-kix_68660h7uawx-5>li:before{content:"\0025a0 "}ol{margin:0;padding:0}table td,table th{padding:0}.HZWKYxoXby-c2{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:156.8pt;border-top-color:#000000;border-bottom-style:solid}.HZWKYxoXby-c9{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:155.2pt;border-top-color:#000000;border-bottom-style:solid}.HZWKYxoXby-c3{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:156pt;border-top-color:#000000;border-bottom-style:solid}.HZWKYxoXby-c19{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:8pt;font-family:"Arial";font-style:normal}.HZWKYxoXby-c15{color:#000000;font-weight:700;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.HZWKYxoXby-c5{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.HZWKYxoXby-c4{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.HZWKYxoXby-c6{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.HZWKYxoXby-c12{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial"}.HZWKYxoXby-c17{border-spacing:0;border-collapse:collapse;margin-right:auto}.HZWKYxoXby-c0{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.HZWKYxoXby-c1{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.HZWKYxoXby-c14{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.HZWKYxoXby-c18{margin-left:36pt;padding-left:0pt}.HZWKYxoXby-c8{color:inherit;text-decoration:inherit}.HZWKYxoXby-c13{padding:0;margin:0}.HZWKYxoXby-c21{font-weight:700}.HZWKYxoXby-c7{height:0pt}.HZWKYxoXby-c20{margin-left:36pt}.HZWKYxoXby-c11{height:11pt}.HZWKYxoXby-c16{margin-left:72pt}.HZWKYxoXby-c10{font-style:italic}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by Maddie Stone, Google Project Zero

/* latin */ @font-face { font-family: 'Consolas'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/l/font?kit=X7nm4bA-A_-9jbjWaza9xMk&skey=3d1eb1871fcc58a1&v=v20) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } @import url('https://themes.googleusercontent.com/fonts/css?kit=lhDjYqiy3mZ0x6ROQEUoUw'); .post-body{.lst-kix_vnkr79j0brd5-6>li:before{content:"\0025cf "}.lst-kix_vnkr79j0brd5-8>li:before{content:"\0025a0 "}ol.lst-kix_rpn0sahs9m0k-5.start{counter-reset:lst-ctn-kix_rpn0sahs9m0k-5 0}.lst-kix_rpn0sahs9m0k-1>li{counter-increment:lst-ctn-kix_rpn0sahs9m0k-1}.lst-kix_vnkr79j0brd5-5>li:before{content:"\0025a0 "}.lst-kix_vnkr79j0brd5-2>li:before{content:"\0025a0 "}.lst-kix_vnkr79j0brd5-4>li:before{content:"\0025cb "}ol.lst-kix_rpn0sahs9m0k-8.start{counter-reset:lst-ctn-kix_rpn0sahs9m0k-8 0}.lst-kix_vnkr79j0brd5-3>li:before{content:"\0025cf "}.lst-kix_vnkr79j0brd5-0>li:before{content:"\0025cf "}.lst-kix_vnkr79j0brd5-1>li:before{content:"\0025cb "}ol.lst-kix_omx22nj2js1z-1.start{counter-reset:lst-ctn-kix_omx22nj2js1z-1 0}.lst-kix_omx22nj2js1z-0>li{counter-increment:lst-ctn-kix_omx22nj2js1z-0}ul.lst-kix_vnkr79j0brd5-4{list-style-type:none}ul.lst-kix_vnkr79j0brd5-3{list-style-type:none}ul.lst-kix_vnkr79j0brd5-2{list-style-type:none}ul.lst-kix_vnkr79j0brd5-1{list-style-type:none}.lst-kix_omx22nj2js1z-1>li:before{content:"" counter(lst-ctn-kix_omx22nj2js1z-1,lower-latin) ". "}ul.lst-kix_vnkr79j0brd5-8{list-style-type:none}ol.lst-kix_rpn0sahs9m0k-0.start{counter-reset:lst-ctn-kix_rpn0sahs9m0k-0 0}ul.lst-kix_vnkr79j0brd5-7{list-style-type:none}.lst-kix_omx22nj2js1z-0>li:before{content:"" counter(lst-ctn-kix_omx22nj2js1z-0,decimal) ". "}ul.lst-kix_vnkr79j0brd5-6{list-style-type:none}ul.lst-kix_vnkr79j0brd5-5{list-style-type:none}ul.lst-kix_vnkr79j0brd5-0{list-style-type:none}.lst-kix_vnkr79j0brd5-7>li:before{content:"\0025cb "}.lst-kix_omx22nj2js1z-2>li{counter-increment:lst-ctn-kix_omx22nj2js1z-2}.lst-kix_omx22nj2js1z-8>li{counter-increment:lst-ctn-kix_omx22nj2js1z-8}.lst-kix_3vloefecb731-0>li:before{content:"\0025cf "}ol.lst-kix_omx22nj2js1z-0.start{counter-reset:lst-ctn-kix_omx22nj2js1z-0 0}ul.lst-kix_ziaggw1wsf95-3{list-style-type:none}ul.lst-kix_ziaggw1wsf95-4{list-style-type:none}ol.lst-kix_omx22nj2js1z-7.start{counter-reset:lst-ctn-kix_omx22nj2js1z-7 0}ul.lst-kix_ziaggw1wsf95-5{list-style-type:none}ol.lst-kix_rpn0sahs9m0k-3.start{counter-reset:lst-ctn-kix_rpn0sahs9m0k-3 0}ul.lst-kix_ziaggw1wsf95-6{list-style-type:none}ul.lst-kix_ziaggw1wsf95-0{list-style-type:none}ul.lst-kix_ziaggw1wsf95-1{list-style-type:none}ul.lst-kix_ziaggw1wsf95-2{list-style-type:none}ul.lst-kix_3vloefecb731-0{list-style-type:none}.lst-kix_3vloefecb731-5>li:before{content:"\0025a0 "}.lst-kix_3vloefecb731-4>li:before{content:"\0025cb "}.lst-kix_3vloefecb731-1>li:before{content:"\0025cb "}ul.lst-kix_3vloefecb731-8{list-style-type:none}ul.lst-kix_3vloefecb731-7{list-style-type:none}ul.lst-kix_3vloefecb731-6{list-style-type:none}ul.lst-kix_3vloefecb731-5{list-style-type:none}.lst-kix_3vloefecb731-3>li:before{content:"\0025cf "}ul.lst-kix_3vloefecb731-4{list-style-type:none}ul.lst-kix_3vloefecb731-3{list-style-type:none}.lst-kix_3vloefecb731-2>li:before{content:"\0025a0 "}ul.lst-kix_3vloefecb731-2{list-style-type:none}ul.lst-kix_3vloefecb731-1{list-style-type:none}.lst-kix_rpn0sahs9m0k-8>li{counter-increment:lst-ctn-kix_rpn0sahs9m0k-8}ol.lst-kix_omx22nj2js1z-6.start{counter-reset:lst-ctn-kix_omx22nj2js1z-6 0}.lst-kix_rpn0sahs9m0k-2>li{counter-increment:lst-ctn-kix_rpn0sahs9m0k-2}.lst-kix_rpn0sahs9m0k-5>li{counter-increment:lst-ctn-kix_rpn0sahs9m0k-5}.lst-kix_3vloefecb731-7>li:before{content:"\0025cb "}.lst-kix_3vloefecb731-6>li:before{content:"\0025cf "}.lst-kix_3vloefecb731-8>li:before{content:"\0025a0 "}ol.lst-kix_rpn0sahs9m0k-2.start{counter-reset:lst-ctn-kix_rpn0sahs9m0k-2 0}.lst-kix_omx22nj2js1z-5>li{counter-increment:lst-ctn-kix_omx22nj2js1z-5}ol.lst-kix_rpn0sahs9m0k-1.start{counter-reset:lst-ctn-kix_rpn0sahs9m0k-1 0}.lst-kix_omx22nj2js1z-4>li{counter-increment:lst-ctn-kix_omx22nj2js1z-4}.lst-kix_rpn0sahs9m0k-6>li{counter-increment:lst-ctn-kix_rpn0sahs9m0k-6}ol.lst-kix_rpn0sahs9m0k-4.start{counter-reset:lst-ctn-kix_rpn0sahs9m0k-4 0}ol.lst-kix_omx22nj2js1z-8.start{counter-reset:lst-ctn-kix_omx22nj2js1z-8 0}ol.lst-kix_omx22nj2js1z-2.start{counter-reset:lst-ctn-kix_omx22nj2js1z-2 0}ul.lst-kix_ziaggw1wsf95-7{list-style-type:none}ul.lst-kix_ziaggw1wsf95-8{list-style-type:none}.lst-kix_omx22nj2js1z-3>li{counter-increment:lst-ctn-kix_omx22nj2js1z-3}ol.lst-kix_rpn0sahs9m0k-7.start{counter-reset:lst-ctn-kix_rpn0sahs9m0k-7 0}.lst-kix_omx22nj2js1z-6>li{counter-increment:lst-ctn-kix_omx22nj2js1z-6}.lst-kix_rpn0sahs9m0k-4>li{counter-increment:lst-ctn-kix_rpn0sahs9m0k-4}.lst-kix_rpn0sahs9m0k-7>li{counter-increment:lst-ctn-kix_rpn0sahs9m0k-7}ol.lst-kix_omx22nj2js1z-5.start{counter-reset:lst-ctn-kix_omx22nj2js1z-5 0}.lst-kix_rpn0sahs9m0k-5>li:before{content:"(" counter(lst-ctn-kix_rpn0sahs9m0k-5,lower-roman) ") "}.lst-kix_rpn0sahs9m0k-6>li:before{content:"" counter(lst-ctn-kix_rpn0sahs9m0k-6,decimal) ". "}.lst-kix_rpn0sahs9m0k-4>li:before{content:"(" counter(lst-ctn-kix_rpn0sahs9m0k-4,lower-latin) ") "}.lst-kix_rpn0sahs9m0k-8>li:before{content:"" counter(lst-ctn-kix_rpn0sahs9m0k-8,lower-roman) ". "}.lst-kix_rpn0sahs9m0k-1>li:before{content:"" counter(lst-ctn-kix_rpn0sahs9m0k-1,lower-latin) ") "}.lst-kix_rpn0sahs9m0k-2>li:before{content:"" counter(lst-ctn-kix_rpn0sahs9m0k-2,lower-roman) ") "}.lst-kix_rpn0sahs9m0k-3>li:before{content:"(" counter(lst-ctn-kix_rpn0sahs9m0k-3,decimal) ") "}.lst-kix_omx22nj2js1z-2>li:before{content:"" counter(lst-ctn-kix_omx22nj2js1z-2,lower-roman) ". "}.lst-kix_rpn0sahs9m0k-3>li{counter-increment:lst-ctn-kix_rpn0sahs9m0k-3}.lst-kix_omx22nj2js1z-3>li:before{content:"" counter(lst-ctn-kix_omx22nj2js1z-3,decimal) ". "}ol.lst-kix_omx22nj2js1z-3.start{counter-reset:lst-ctn-kix_omx22nj2js1z-3 0}ol.lst-kix_rpn0sahs9m0k-7{list-style-type:none}ol.lst-kix_rpn0sahs9m0k-8{list-style-type:none}.lst-kix_omx22nj2js1z-5>li:before{content:"" counter(lst-ctn-kix_omx22nj2js1z-5,lower-roman) ". "}.lst-kix_ziaggw1wsf95-0>li:before{content:"\0025cf "}.lst-kix_rpn0sahs9m0k-0>li:before{content:"" counter(lst-ctn-kix_rpn0sahs9m0k-0,decimal) ") "}.lst-kix_omx22nj2js1z-4>li:before{content:"" counter(lst-ctn-kix_omx22nj2js1z-4,lower-latin) ". "}.lst-kix_omx22nj2js1z-7>li{counter-increment:lst-ctn-kix_omx22nj2js1z-7}.lst-kix_omx22nj2js1z-7>li:before{content:"" counter(lst-ctn-kix_omx22nj2js1z-7,lower-latin) ". "}ol.lst-kix_rpn0sahs9m0k-1{list-style-type:none}ol.lst-kix_rpn0sahs9m0k-2{list-style-type:none}ol.lst-kix_rpn0sahs9m0k-0{list-style-type:none}ol.lst-kix_rpn0sahs9m0k-5{list-style-type:none}ol.lst-kix_rpn0sahs9m0k-6{list-style-type:none}.lst-kix_omx22nj2js1z-6>li:before{content:"" counter(lst-ctn-kix_omx22nj2js1z-6,decimal) ". "}ol.lst-kix_rpn0sahs9m0k-3{list-style-type:none}ol.lst-kix_rpn0sahs9m0k-6.start{counter-reset:lst-ctn-kix_rpn0sahs9m0k-6 0}.lst-kix_omx22nj2js1z-1>li{counter-increment:lst-ctn-kix_omx22nj2js1z-1}ol.lst-kix_rpn0sahs9m0k-4{list-style-type:none}.lst-kix_ziaggw1wsf95-6>li:before{content:"\0025cf "}ol.lst-kix_omx22nj2js1z-0{list-style-type:none}.lst-kix_ziaggw1wsf95-5>li:before{content:"\0025a0 "}.lst-kix_ziaggw1wsf95-7>li:before{content:"\0025cb "}.lst-kix_ziaggw1wsf95-4>li:before{content:"\0025cb "}.lst-kix_ziaggw1wsf95-8>li:before{content:"\0025a0 "}.lst-kix_omx22nj2js1z-8>li:before{content:"" counter(lst-ctn-kix_omx22nj2js1z-8,lower-roman) ". "}ol.lst-kix_omx22nj2js1z-6{list-style-type:none}.lst-kix_ziaggw1wsf95-2>li:before{content:"\0025a0 "}ol.lst-kix_omx22nj2js1z-5{list-style-type:none}ol.lst-kix_omx22nj2js1z-4.start{counter-reset:lst-ctn-kix_omx22nj2js1z-4 0}ol.lst-kix_omx22nj2js1z-8{list-style-type:none}.lst-kix_ziaggw1wsf95-1>li:before{content:"\0025cb "}.lst-kix_ziaggw1wsf95-3>li:before{content:"\0025cf "}ol.lst-kix_omx22nj2js1z-7{list-style-type:none}ol.lst-kix_omx22nj2js1z-2{list-style-type:none}ol.lst-kix_omx22nj2js1z-1{list-style-type:none}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ol.lst-kix_omx22nj2js1z-4{list-style-type:none}ol.lst-kix_omx22nj2js1z-3{list-style-type:none}.lst-kix_rpn0sahs9m0k-0>li{counter-increment:lst-ctn-kix_rpn0sahs9m0k-0}.lst-kix_rpn0sahs9m0k-7>li:before{content:"" counter(lst-ctn-kix_rpn0sahs9m0k-7,lower-latin) ". "}ol{margin:0;padding:0}table td,table th{padding:0}.ZslSztaQWN-c45{border-right-style:solid;padding-top:1.7pt;border-top-width:0pt;border-right-width:0pt;padding-left:8.5pt;padding-bottom:4.2pt;line-height:1.5;border-left-width:0pt;border-top-style:solid;border-left-style:solid;border-bottom-width:0pt;border-bottom-style:solid;text-align:left;padding-right:0pt}.ZslSztaQWN-c9{border-right-style:solid;padding:0pt 4pt 0pt 4pt;border-bottom-color:#999988;border-top-width:1pt;border-right-width:1pt;border-left-color:#d7d7d7;vertical-align:top;border-right-color:#00aa00;border-left-width:1pt;border-top-style:solid;background-color:#eeeedd;border-left-style:solid;border-bottom-width:1pt;width:30pt;border-top-color:#999988;border-bottom-style:solid}.ZslSztaQWN-c49{border-right-style:solid;padding:1pt 2pt 1pt 2pt;border-bottom-color:#00aa00;border-top-width:0pt;border-right-width:1pt;border-left-color:#00aa00;vertical-align:top;border-right-color:#00aa00;border-left-width:1pt;border-top-style:solid;background-color:#ddffdd;border-left-style:solid;border-bottom-width:1pt;width:421.5pt;border-top-color:#cc0000;border-bottom-style:solid}.ZslSztaQWN-c38{border-right-style:solid;padding:0pt 2pt 0pt 2pt;border-bottom-color:#999988;border-top-width:1pt;border-right-width:1pt;border-left-color:#d7d7d7;vertical-align:top;border-right-color:#d7d7d7;border-left-width:1pt;border-top-style:solid;background-color:#eeeeee;border-left-style:solid;border-bottom-width:1pt;width:30pt;border-top-color:#d7d7d7;border-bottom-style:solid}.ZslSztaQWN-c30{border-right-style:solid;padding:0pt 2pt 0pt 2pt;border-bottom-color:#999988;border-top-width:1pt;border-right-width:1pt;border-left-color:#999999;vertical-align:top;border-right-color:#d7d7d7;border-left-width:0pt;border-top-style:solid;background-color:#eeeeee;border-left-style:solid;border-bottom-width:1pt;width:27pt;border-top-color:#d7d7d7;border-bottom-style:solid}.ZslSztaQWN-c44{border-right-style:solid;padding:1pt 2pt 1pt 2pt;border-bottom-color:#cc0000;border-top-width:0pt;border-right-width:0pt;border-left-color:#d7d7d7;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;background-color:#ffffff;border-left-style:solid;border-bottom-width:1pt;width:421.5pt;border-top-color:#000000;border-bottom-style:solid}.ZslSztaQWN-c36{border-right-style:solid;padding:0pt 4pt 0pt 4pt;border-bottom-color:#999988;border-top-width:1pt;border-right-width:1pt;border-left-color:#d7d7d7;vertical-align:top;border-right-color:#cc0000;border-left-width:1pt;border-top-style:solid;background-color:#eeeedd;border-left-style:solid;border-bottom-width:1pt;width:30pt;border-top-color:#999988;border-bottom-style:solid}.ZslSztaQWN-c51{border-right-style:solid;padding:1pt 2pt 1pt 2pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:0pt;border-left-color:#d7d7d7;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;background-color:#ffffff;border-left-style:solid;border-bottom-width:0pt;width:421.5pt;border-top-color:#d7d7d7;border-bottom-style:solid}.ZslSztaQWN-c13{border-right-style:solid;padding:0pt 4pt 0pt 4pt;border-bottom-color:#999988;border-top-width:1pt;border-right-width:1pt;border-left-color:#888866;vertical-align:top;border-right-color:#d7d7d7;border-left-width:0pt;border-top-style:solid;background-color:#eeeedd;border-left-style:solid;border-bottom-width:1pt;width:27pt;border-top-color:#999988;border-bottom-style:solid}.ZslSztaQWN-c48{border-right-style:solid;padding:0pt 4pt 0pt 4pt;border-bottom-color:#999988;border-top-width:1pt;border-right-width:1pt;border-left-color:#d7d7d7;vertical-align:top;border-right-color:#d7d7d7;border-left-width:1pt;border-top-style:solid;background-color:#eeeedd;border-left-style:solid;border-bottom-width:1pt;width:30pt;border-top-color:#999988;border-bottom-style:solid}.ZslSztaQWN-c10{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#e0e0e0;border-top-width:1pt;border-right-width:1pt;border-left-color:#e0e0e0;vertical-align:top;border-right-color:#e0e0e0;border-left-width:1pt;border-top-style:solid;background-color:#fafafa;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#e0e0e0;border-bottom-style:solid}.ZslSztaQWN-c50{border-right-style:solid;padding:1pt 2pt 1pt 2pt;border-bottom-color:#d7d7d7;border-top-width:1pt;border-right-width:1pt;border-left-color:#d7d7d7;vertical-align:top;border-right-color:#d7d7d7;border-left-width:1pt;border-top-style:solid;background-color:#f7f7f7;border-left-style:solid;border-bottom-width:1pt;width:421.5pt;border-top-color:#d7d7d7;border-bottom-style:solid}.ZslSztaQWN-c34{border-right-style:solid;padding:1pt 2pt 1pt 2pt;border-bottom-color:#cc0000;border-top-width:1pt;border-right-width:1pt;border-left-color:#cc0000;vertical-align:top;border-right-color:#cc0000;border-left-width:1pt;border-top-style:solid;background-color:#ffdddd;border-left-style:solid;border-bottom-width:0pt;width:421.5pt;border-top-color:#cc0000;border-bottom-style:solid}.ZslSztaQWN-c18{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:center;height:11pt}.ZslSztaQWN-c11{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.ZslSztaQWN-c5{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.ZslSztaQWN-c31{padding-top:20pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;text-align:left}.ZslSztaQWN-c52{padding-top:6pt;padding-bottom:0pt;line-height:1.45;text-align:left}.ZslSztaQWN-c46{font-size:10pt;font-family:Consolas,"Courier New";color:#9c27b0;font-weight:400}.ZslSztaQWN-c24{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:right}.ZslSztaQWN-c8{color:#000000;font-weight:400;font-size:20pt;font-family:"Arial"}.ZslSztaQWN-c25{color:#24292f;font-weight:400;font-size:10pt;font-family:Consolas,"Courier New"}.ZslSztaQWN-c12{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:left}.ZslSztaQWN-c17{font-size:10pt;font-family:Consolas,"Courier New";color:#0f9d58;font-weight:400}.ZslSztaQWN-c0{font-size:10pt;font-family:Consolas,"Courier New";color:#000000;font-weight:400}.ZslSztaQWN-c32{font-size:10pt;font-family:Consolas,"Courier New";color:#455a64;font-weight:400}.ZslSztaQWN-c21{color:#000000;font-weight:400;font-size:7pt;font-family:"Verdana"}.ZslSztaQWN-c1{font-size:10pt;font-family:Consolas,"Courier New";color:#3367d6;font-weight:400}.ZslSztaQWN-c33{font-size:7pt;font-family:"Verdana";color:#888866;font-weight:400}.ZslSztaQWN-c16{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.ZslSztaQWN-c3{font-size:10pt;font-family:Consolas,"Courier New";color:#c53929;font-weight:400}.ZslSztaQWN-c27{border-spacing:0;border-collapse:collapse;margin-right:auto}.ZslSztaQWN-c42{color:#333333;font-weight:700;font-size:11pt;font-family:"Arial"}.ZslSztaQWN-c2{font-size:10pt;font-family:Consolas,"Courier New";color:#616161;font-weight:400}.ZslSztaQWN-c28{font-size:7pt;font-family:"Courier New";font-weight:400}.ZslSztaQWN-c43{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.ZslSztaQWN-c4{font-family:Consolas,"Courier New";color:#0d904f;font-weight:400}.ZslSztaQWN-c6{text-decoration:none;vertical-align:baseline;font-style:normal}.ZslSztaQWN-c19{orphans:2;widows:2}.ZslSztaQWN-c29{color:#1155cc;font-weight:700}.ZslSztaQWN-c23{margin-left:36pt;padding-left:0pt}.ZslSztaQWN-c47{font-weight:400;font-family:Consolas,"Courier New"}.ZslSztaQWN-c14{color:inherit;text-decoration:inherit}.ZslSztaQWN-c22{padding:0;margin:0}.ZslSztaQWN-c26{margin-left:72pt;padding-left:0pt}.ZslSztaQWN-c20{height:11pt}.ZslSztaQWN-c15{height:0pt}.ZslSztaQWN-c37{background-color:#99ee99}.ZslSztaQWN-c40{height:11.2pt}.ZslSztaQWN-c35{height:12pt}.ZslSztaQWN-c7{height:12.8pt}.ZslSztaQWN-c39{background-color:#ee9999}.ZslSztaQWN-c41{margin-left:36pt}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by Maddie Stone, Google Project Zero

/* latin */ @font-face { font-family: 'Consolas'; font-style: normal; font-weight: 400; src: url(https://fonts.gstatic.com/l/font?kit=X7nm4bA-A_-9jbjWaza9xMk&skey=3d1eb1871fcc58a1&v=v20) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD; } @import url('https://themes.googleusercontent.com/fonts/css?kit=lhDjYqiy3mZ0x6ROQEUoUw'); .post-body{ul.lst-kix_wl1qmy9tv69d-1{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-0{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-8{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-7{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-6{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-5{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-4{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-3{list-style-type:none}ul.lst-kix_wl1qmy9tv69d-2{list-style-type:none}.lst-kix_vvah8cp3zgua-1>li:before{content:"\0025cb "}.lst-kix_kan00gftou8h-7>li:before{content:"\0025cb "}.lst-kix_a41x0ya2xyd3-6>li:before{content:"\0025cf "}.lst-kix_a41x0ya2xyd3-8>li:before{content:"\0025a0 "}.lst-kix_vvah8cp3zgua-0>li:before{content:"\0025cf "}.lst-kix_kan00gftou8h-4>li:before{content:"\0025cb "}.lst-kix_kan00gftou8h-8>li:before{content:"\0025a0 "}.lst-kix_a41x0ya2xyd3-3>li:before{content:"\0025cf "}.lst-kix_a41x0ya2xyd3-7>li:before{content:"\0025cb "}.lst-kix_a41x0ya2xyd3-4>li:before{content:"\0025cb "}.lst-kix_kan00gftou8h-5>li:before{content:"\0025a0 "}.lst-kix_kan00gftou8h-6>li:before{content:"\0025cf "}.lst-kix_a41x0ya2xyd3-5>li:before{content:"\0025a0 "}ul.lst-kix_h07r6gi9x3gp-0{list-style-type:none}.lst-kix_h07r6gi9x3gp-7>li:before{content:"\0025cb "}ul.lst-kix_40ztqamj21pm-1{list-style-type:none}ul.lst-kix_40ztqamj21pm-0{list-style-type:none}.lst-kix_vkloremw4n8w-2>li:before{content:"\0025a0 "}.lst-kix_h07r6gi9x3gp-6>li:before{content:"\0025cf "}.lst-kix_a41x0ya2xyd3-0>li:before{content:"\0025cf "}.lst-kix_h07r6gi9x3gp-5>li:before{content:"\0025a0 "}.lst-kix_vkloremw4n8w-3>li:before{content:"\0025cf "}.lst-kix_vkloremw4n8w-4>li:before{content:"\0025cb "}.lst-kix_h07r6gi9x3gp-3>li:before{content:"\0025cf "}ul.lst-kix_h07r6gi9x3gp-8{list-style-type:none}ul.lst-kix_h07r6gi9x3gp-7{list-style-type:none}.lst-kix_vkloremw4n8w-5>li:before{content:"\0025a0 "}.lst-kix_vkloremw4n8w-6>li:before{content:"\0025cf "}.lst-kix_h07r6gi9x3gp-2>li:before{content:"\0025a0 "}.lst-kix_h07r6gi9x3gp-4>li:before{content:"\0025cb "}ul.lst-kix_h07r6gi9x3gp-6{list-style-type:none}.lst-kix_a41x0ya2xyd3-2>li:before{content:"\0025a0 "}ul.lst-kix_h07r6gi9x3gp-5{list-style-type:none}ul.lst-kix_h07r6gi9x3gp-4{list-style-type:none}ul.lst-kix_h07r6gi9x3gp-3{list-style-type:none}ul.lst-kix_h07r6gi9x3gp-2{list-style-type:none}.lst-kix_a41x0ya2xyd3-1>li:before{content:"\0025cb "}ul.lst-kix_h07r6gi9x3gp-1{list-style-type:none}.lst-kix_vkloremw4n8w-7>li:before{content:"\0025cb "}.lst-kix_vkloremw4n8w-8>li:before{content:"\0025a0 "}ul.lst-kix_e7a7d17rpo44-7{list-style-type:none}ul.lst-kix_vkloremw4n8w-4{list-style-type:none}ul.lst-kix_e7a7d17rpo44-6{list-style-type:none}ul.lst-kix_vkloremw4n8w-3{list-style-type:none}ul.lst-kix_vkloremw4n8w-6{list-style-type:none}ul.lst-kix_e7a7d17rpo44-8{list-style-type:none}ul.lst-kix_vkloremw4n8w-5{list-style-type:none}ul.lst-kix_e7a7d17rpo44-3{list-style-type:none}ul.lst-kix_vkloremw4n8w-8{list-style-type:none}ul.lst-kix_e7a7d17rpo44-2{list-style-type:none}ul.lst-kix_vkloremw4n8w-7{list-style-type:none}ul.lst-kix_e7a7d17rpo44-5{list-style-type:none}ul.lst-kix_e7a7d17rpo44-4{list-style-type:none}.lst-kix_h07r6gi9x3gp-8>li:before{content:"\0025a0 "}ul.lst-kix_e7a7d17rpo44-1{list-style-type:none}ul.lst-kix_e7a7d17rpo44-0{list-style-type:none}.lst-kix_e7a7d17rpo44-1>li:before{content:"\0025cb "}ul.lst-kix_vkloremw4n8w-0{list-style-type:none}.lst-kix_kan00gftou8h-0>li:before{content:"\0025cf "}ul.lst-kix_vkloremw4n8w-2{list-style-type:none}.lst-kix_e7a7d17rpo44-2>li:before{content:"\0025a0 "}ul.lst-kix_vkloremw4n8w-1{list-style-type:none}.lst-kix_kan00gftou8h-3>li:before{content:"\0025cf "}.lst-kix_e7a7d17rpo44-3>li:before{content:"\0025cf "}.lst-kix_e7a7d17rpo44-5>li:before{content:"\0025a0 "}.lst-kix_kan00gftou8h-1>li:before{content:"\0025cb "}.lst-kix_kan00gftou8h-2>li:before{content:"\0025a0 "}.lst-kix_e7a7d17rpo44-4>li:before{content:"\0025cb "}.lst-kix_e7a7d17rpo44-7>li:before{content:"\0025cb "}ul.lst-kix_kan00gftou8h-7{list-style-type:none}ul.lst-kix_kan00gftou8h-6{list-style-type:none}ul.lst-kix_kan00gftou8h-8{list-style-type:none}.lst-kix_e7a7d17rpo44-6>li:before{content:"\0025cf "}ul.lst-kix_kan00gftou8h-3{list-style-type:none}ul.lst-kix_kan00gftou8h-2{list-style-type:none}ul.lst-kix_kan00gftou8h-5{list-style-type:none}ul.lst-kix_kan00gftou8h-4{list-style-type:none}ul.lst-kix_kan00gftou8h-1{list-style-type:none}ul.lst-kix_kan00gftou8h-0{list-style-type:none}.lst-kix_e7a7d17rpo44-0>li:before{content:"\0025cf "}.lst-kix_e7a7d17rpo44-8>li:before{content:"\0025a0 "}ul.lst-kix_vvah8cp3zgua-5{list-style-type:none}ul.lst-kix_vvah8cp3zgua-6{list-style-type:none}.lst-kix_h07r6gi9x3gp-0>li:before{content:"\0025cf "}ul.lst-kix_vvah8cp3zgua-3{list-style-type:none}ul.lst-kix_vvah8cp3zgua-4{list-style-type:none}.lst-kix_h07r6gi9x3gp-1>li:before{content:"\0025cb "}ul.lst-kix_vvah8cp3zgua-7{list-style-type:none}ul.lst-kix_vvah8cp3zgua-8{list-style-type:none}ul.lst-kix_40ztqamj21pm-8{list-style-type:none}ul.lst-kix_40ztqamj21pm-7{list-style-type:none}ul.lst-kix_40ztqamj21pm-6{list-style-type:none}ul.lst-kix_40ztqamj21pm-5{list-style-type:none}ul.lst-kix_40ztqamj21pm-4{list-style-type:none}ul.lst-kix_40ztqamj21pm-3{list-style-type:none}ul.lst-kix_40ztqamj21pm-2{list-style-type:none}.lst-kix_vkloremw4n8w-1>li:before{content:"\0025cb "}.lst-kix_vkloremw4n8w-0>li:before{content:"\0025cf "}ul.lst-kix_vvah8cp3zgua-1{list-style-type:none}ul.lst-kix_vvah8cp3zgua-2{list-style-type:none}ul.lst-kix_vvah8cp3zgua-0{list-style-type:none}.lst-kix_vvah8cp3zgua-2>li:before{content:"\0025a0 "}.lst-kix_vvah8cp3zgua-3>li:before{content:"\0025cf "}.lst-kix_40ztqamj21pm-1>li:before{content:"\0025cb "}.lst-kix_vvah8cp3zgua-4>li:before{content:"\0025cb "}.lst-kix_vvah8cp3zgua-6>li:before{content:"\0025cf "}.lst-kix_40ztqamj21pm-2>li:before{content:"\0025a0 "}.lst-kix_vvah8cp3zgua-5>li:before{content:"\0025a0 "}.lst-kix_vvah8cp3zgua-8>li:before{content:"\0025a0 "}ul.lst-kix_a41x0ya2xyd3-8{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-7{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-6{list-style-type:none}.lst-kix_wl1qmy9tv69d-8>li:before{content:"\0025a0 "}ul.lst-kix_a41x0ya2xyd3-5{list-style-type:none}.lst-kix_40ztqamj21pm-0>li:before{content:"\0025cf "}.lst-kix_vvah8cp3zgua-7>li:before{content:"\0025cb "}ul.lst-kix_a41x0ya2xyd3-4{list-style-type:none}.lst-kix_wl1qmy9tv69d-7>li:before{content:"\0025cb "}ul.lst-kix_a41x0ya2xyd3-3{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-2{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-1{list-style-type:none}ul.lst-kix_a41x0ya2xyd3-0{list-style-type:none}.lst-kix_wl1qmy9tv69d-5>li:before{content:"\0025a0 "}.lst-kix_wl1qmy9tv69d-6>li:before{content:"\0025cf "}.lst-kix_wl1qmy9tv69d-3>li:before{content:"\0025cf "}.lst-kix_wl1qmy9tv69d-0>li:before{content:"\0025cf "}.lst-kix_wl1qmy9tv69d-4>li:before{content:"\0025cb "}.lst-kix_40ztqamj21pm-8>li:before{content:"\0025a0 "}.lst-kix_wl1qmy9tv69d-1>li:before{content:"\0025cb "}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}.lst-kix_wl1qmy9tv69d-2>li:before{content:"\0025a0 "}.lst-kix_40ztqamj21pm-3>li:before{content:"\0025cf "}.lst-kix_40ztqamj21pm-5>li:before{content:"\0025a0 "}.lst-kix_40ztqamj21pm-4>li:before{content:"\0025cb "}.lst-kix_40ztqamj21pm-7>li:before{content:"\0025cb "}.lst-kix_40ztqamj21pm-6>li:before{content:"\0025cf "}ol{margin:0;padding:0}table td,table th{padding:0}.c11{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:104.2pt;border-top-color:#000000;border-bottom-style:solid}.c3{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:105.8pt;border-top-color:#000000;border-bottom-style:solid}.c15{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:62.2pt;border-top-color:#000000;border-bottom-style:solid}.c2{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:50.2pt;border-top-color:#000000;border-bottom-style:solid}.c12{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:84.8pt;border-top-color:#000000;border-bottom-style:solid}.c8{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:105pt;border-top-color:#000000;border-bottom-style:solid}.c18{-webkit-text-decoration-skip:none;color:#00796b;font-weight:400;text-decoration:line-through;vertical-align:baseline;text-decoration-skip-ink:none;font-size:11pt;font-family:"Arial";font-style:normal}.c6{margin-left:36pt;padding-top:0pt;padding-left:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c5{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c20{padding-top:20pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c0{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c1{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:20pt;font-family:"Arial";font-style:normal}.c4{padding-top:0pt;padding-bottom:0pt;line-height:1.0;orphans:2;widows:2;text-align:left}.c9{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c16{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c23{border-spacing:0;border-collapse:collapse;margin-right:auto}.c10{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c22{font-family:Consolas,"Courier New";color:#0d904f;font-weight:400}.c7{padding:0;margin:0}.c13{color:inherit;text-decoration:inherit}.c21{height:11pt}.c14{height:0pt}.c19{margin-left:36pt}.c17{font-style:italic}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by Maddie Stone, Project Zero

In May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a more focused effort on analyzing and learning from these exploits. This is another way Project Zero is trying to make zero-day hard. This blog post synthesizes many of our efforts and what we’ve seen over the last year. We provide a review of what we can learn from 0-day exploits detected as used in the wild in 2019. In conjunction with this blog post, we are also publishing another blog post today about our root cause analysis work that informed the conclusions in this Year in Review. We are also releasing 8 root cause analyses that we have done for in-the-wild 0-days from 2019.