TFW you-get-really-excited-you-patch-diffed-a-0day-used-in-the-wild-but-then-find-out-it-is-the-wrong-vuln

In May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a more focused effort on analyzing and learning from these exploits. This is another way Project Zero is trying to make zero-day hard. This blog post synthesizes many of our efforts and what we’ve seen over the last year. We provide a review of what we can learn from 0-day exploits detected as used in the wild in 2019. In conjunction with this blog post, we are also publishing another blog post today about our root cause analysis work that informed the conclusions in this Year in Review. We are also releasing 8 root cause analyses that we have done for in-the-wild 0-days from 2019.

Our effort on this began in earnest in the last quarter of 2019. Today we are beginning to publish the root cause analyses for 0-days exploited in the wild that we have completed. While we’re publishing some in bulk now to play “catch-up”, in the future we plan to post each one in a timely manner after it’s detected and disclosed. We think publishing technical details in a timely manner is important for transparency and so that the whole of the security community can make informed decisions and actions.

CVE-2026-0300 is a pre-auth buffer overflow in the PAN-OS User-ID Authentication Portal giving unauthenticated root RCE on PA-Series and VM-Series firewalls, already exploited in the wild.

An analysis of CVE-2023-0266 as used in a modern in-the-wild Android exploit, dissecting the vulnerability, the exploitation strategy, and defensive lessons learned.

.post-body{ul.lst-kix_lw3zh1qbhlji-0{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-1{list-style-type:none}.lst-kix_f28qers2ka94-4>li{counter-increment:lst-ctn-kix_f28qers2ka94-4}ul.lst-kix_lw3zh1qbhlji-6{list-style-type:none}.lst-kix_o1lgec7ujykk-8>li:before{content:"- "}ul.lst-kix_lw3zh1qbhlji-7{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-8{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-2{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-3{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-4{list-style-type:none}ul.lst-kix_lw3zh1qbhlji-5{list-style-type:none}ol.lst-kix_f28qers2ka94-5.start{counter-reset:lst-ctn-kix_f28qers2ka94-5 0}.lst-kix_f28qers2ka94-2>li{counter-increment:lst-ctn-kix_f28qers2ka94-2}.lst-kix_thuqgp6gfs8h-2>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-2}.lst-kix_olvs1jbt89fl-4>li:before{content:"- "}.lst-kix_olvs1jbt89fl-5>li:before{content:"- "}.lst-kix_olvs1jbt89fl-7>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-4>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-4}.lst-kix_olvs1jbt89fl-6>li:before{content:"- "}ol.lst-kix_thuqgp6gfs8h-4.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-4 0}.lst-kix_olvs1jbt89fl-8>li:before{content:"- "}ul.lst-kix_5kmetj22qqvk-7{list-style-type:none}ul.lst-kix_5kmetj22qqvk-6{list-style-type:none}ul.lst-kix_5kmetj22qqvk-5{list-style-type:none}ul.lst-kix_5kmetj22qqvk-4{list-style-type:none}ul.lst-kix_5kmetj22qqvk-3{list-style-type:none}.lst-kix_thuqgp6gfs8h-6>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-6}ul.lst-kix_5kmetj22qqvk-2{list-style-type:none}ul.lst-kix_5kmetj22qqvk-1{list-style-type:none}ul.lst-kix_5kmetj22qqvk-0{list-style-type:none}ol.lst-kix_f28qers2ka94-6.start{counter-reset:lst-ctn-kix_f28qers2ka94-6 0}ol.lst-kix_thuqgp6gfs8h-3.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-3 0}.lst-kix_5kmetj22qqvk-8>li:before{content:"- "}.lst-kix_olvs1jbt89fl-3>li:before{content:"- "}.lst-kix_olvs1jbt89fl-2>li:before{content:"- "}.lst-kix_5kmetj22qqvk-0>li:before{content:"- "}.lst-kix_olvs1jbt89fl-1>li:before{content:"- "}.lst-kix_f28qers2ka94-8>li{counter-increment:lst-ctn-kix_f28qers2ka94-8}.lst-kix_5kmetj22qqvk-2>li:before{content:"- "}.lst-kix_5kmetj22qqvk-1>li:before{content:"- "}.lst-kix_olvs1jbt89fl-0>li:before{content:"- "}.lst-kix_o1lgec7ujykk-7>li:before{content:"- "}.lst-kix_o1lgec7ujykk-6>li:before{content:"- "}.lst-kix_5kmetj22qqvk-7>li:before{content:"- "}.lst-kix_o1lgec7ujykk-4>li:before{content:"- "}.lst-kix_o1lgec7ujykk-3>li:before{content:"- "}.lst-kix_o1lgec7ujykk-5>li:before{content:"- "}.lst-kix_5kmetj22qqvk-6>li:before{content:"- "}ol.lst-kix_f28qers2ka94-0.start{counter-reset:lst-ctn-kix_f28qers2ka94-0 0}.lst-kix_5kmetj22qqvk-5>li:before{content:"- "}.lst-kix_o1lgec7ujykk-0>li:before{content:"- "}.lst-kix_o1lgec7ujykk-1>li:before{content:"- "}.lst-kix_5kmetj22qqvk-4>li:before{content:"- "}.lst-kix_o1lgec7ujykk-2>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-0>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-0}.lst-kix_5kmetj22qqvk-3>li:before{content:"- "}ul.lst-kix_5kmetj22qqvk-8{list-style-type:none}.lst-kix_c52otkrerajb-7>li:before{content:"- "}ol.lst-kix_f28qers2ka94-4.start{counter-reset:lst-ctn-kix_f28qers2ka94-4 0}.lst-kix_c52otkrerajb-5>li:before{content:"- "}.lst-kix_tjxel15w0vnb-0>li:before{content:"\0025cf "}.lst-kix_b2z7bfhnik92-1>li:before{content:"- "}ol.lst-kix_thuqgp6gfs8h-5.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-5 0}.lst-kix_f28qers2ka94-1>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-1,lower-latin) ". "}ol.lst-kix_f28qers2ka94-1.start{counter-reset:lst-ctn-kix_f28qers2ka94-1 0}ul.lst-kix_t4et3tnq1pzp-3{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-4{list-style-type:none}.lst-kix_b2z7bfhnik92-5>li:before{content:"- "}ul.lst-kix_t4et3tnq1pzp-1{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-2{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-7{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-8{list-style-type:none}.lst-kix_c52otkrerajb-1>li:before{content:"- "}.lst-kix_b2z7bfhnik92-3>li:before{content:"- "}.lst-kix_b2z7bfhnik92-7>li:before{content:"- "}ul.lst-kix_t4et3tnq1pzp-5{list-style-type:none}ul.lst-kix_t4et3tnq1pzp-6{list-style-type:none}.lst-kix_lw3zh1qbhlji-0>li:before{content:"\0025cf "}ol.lst-kix_thuqgp6gfs8h-8.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-8 0}.lst-kix_c52otkrerajb-3>li:before{content:"- "}ul.lst-kix_t4et3tnq1pzp-0{list-style-type:none}ul.lst-kix_tjxel15w0vnb-1{list-style-type:none}ul.lst-kix_tjxel15w0vnb-2{list-style-type:none}ul.lst-kix_tjxel15w0vnb-3{list-style-type:none}ul.lst-kix_tjxel15w0vnb-4{list-style-type:none}ul.lst-kix_tjxel15w0vnb-0{list-style-type:none}ul.lst-kix_tjxel15w0vnb-5{list-style-type:none}ul.lst-kix_tjxel15w0vnb-6{list-style-type:none}ul.lst-kix_tjxel15w0vnb-7{list-style-type:none}ul.lst-kix_tjxel15w0vnb-8{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-7.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-7 0}ul.lst-kix_b2z7bfhnik92-7{list-style-type:none}ul.lst-kix_b2z7bfhnik92-8{list-style-type:none}ul.lst-kix_b2z7bfhnik92-5{list-style-type:none}ul.lst-kix_b2z7bfhnik92-6{list-style-type:none}ul.lst-kix_b2z7bfhnik92-3{list-style-type:none}ul.lst-kix_b2z7bfhnik92-4{list-style-type:none}ul.lst-kix_b2z7bfhnik92-1{list-style-type:none}ul.lst-kix_b2z7bfhnik92-2{list-style-type:none}ul.lst-kix_b2z7bfhnik92-0{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-8{list-style-type:none}ul.lst-kix_c52otkrerajb-0{list-style-type:none}ul.lst-kix_o1lgec7ujykk-5{list-style-type:none}ul.lst-kix_o1lgec7ujykk-6{list-style-type:none}ul.lst-kix_o1lgec7ujykk-7{list-style-type:none}ul.lst-kix_o1lgec7ujykk-8{list-style-type:none}ul.lst-kix_o1lgec7ujykk-1{list-style-type:none}ol.lst-kix_f28qers2ka94-2.start{counter-reset:lst-ctn-kix_f28qers2ka94-2 0}ul.lst-kix_o1lgec7ujykk-2{list-style-type:none}ul.lst-kix_o1lgec7ujykk-3{list-style-type:none}ul.lst-kix_o1lgec7ujykk-4{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-0{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-1{list-style-type:none}.lst-kix_thuqgp6gfs8h-5>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-5}ol.lst-kix_thuqgp6gfs8h-2{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-3{list-style-type:none}.lst-kix_7gtwvv8lds0h-2>li:before{content:"- "}ul.lst-kix_o1lgec7ujykk-0{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-4{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-5{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-6{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-7{list-style-type:none}ol.lst-kix_thuqgp6gfs8h-6.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-6 0}.lst-kix_7gtwvv8lds0h-4>li:before{content:"- "}.lst-kix_7gtwvv8lds0h-6>li:before{content:"- "}.lst-kix_f28qers2ka94-7>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-7,lower-latin) ". "}ul.lst-kix_c52otkrerajb-8{list-style-type:none}.lst-kix_tjxel15w0vnb-8>li:before{content:"\0025a0 "}ul.lst-kix_c52otkrerajb-7{list-style-type:none}ul.lst-kix_c52otkrerajb-6{list-style-type:none}ul.lst-kix_c52otkrerajb-5{list-style-type:none}.lst-kix_7gtwvv8lds0h-8>li:before{content:"- "}ul.lst-kix_c52otkrerajb-4{list-style-type:none}ul.lst-kix_olvs1jbt89fl-6{list-style-type:none}ul.lst-kix_c52otkrerajb-3{list-style-type:none}ul.lst-kix_olvs1jbt89fl-5{list-style-type:none}ul.lst-kix_c52otkrerajb-2{list-style-type:none}ul.lst-kix_olvs1jbt89fl-8{list-style-type:none}ul.lst-kix_c52otkrerajb-1{list-style-type:none}ul.lst-kix_olvs1jbt89fl-7{list-style-type:none}.lst-kix_tjxel15w0vnb-4>li:before{content:"\0025cb "}.lst-kix_f28qers2ka94-3>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-3,decimal) ". "}ul.lst-kix_olvs1jbt89fl-2{list-style-type:none}.lst-kix_f28qers2ka94-0>li{counter-increment:lst-ctn-kix_f28qers2ka94-0}ul.lst-kix_olvs1jbt89fl-1{list-style-type:none}.lst-kix_f28qers2ka94-6>li{counter-increment:lst-ctn-kix_f28qers2ka94-6}ul.lst-kix_olvs1jbt89fl-4{list-style-type:none}ul.lst-kix_olvs1jbt89fl-3{list-style-type:none}.lst-kix_tjxel15w0vnb-2>li:before{content:"\0025a0 "}.lst-kix_tjxel15w0vnb-6>li:before{content:"\0025cf "}ul.lst-kix_olvs1jbt89fl-0{list-style-type:none}ol.lst-kix_f28qers2ka94-3.start{counter-reset:lst-ctn-kix_f28qers2ka94-3 0}.lst-kix_f28qers2ka94-5>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-5,lower-roman) ". "}.lst-kix_thuqgp6gfs8h-3>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-3}.lst-kix_f28qers2ka94-5>li{counter-increment:lst-ctn-kix_f28qers2ka94-5}ol.lst-kix_f28qers2ka94-6{list-style-type:none}ol.lst-kix_f28qers2ka94-5{list-style-type:none}ol.lst-kix_f28qers2ka94-8{list-style-type:none}ol.lst-kix_f28qers2ka94-7{list-style-type:none}ol.lst-kix_f28qers2ka94-2{list-style-type:none}ol.lst-kix_f28qers2ka94-1{list-style-type:none}ol.lst-kix_f28qers2ka94-4{list-style-type:none}ol.lst-kix_f28qers2ka94-3{list-style-type:none}ol.lst-kix_f28qers2ka94-0{list-style-type:none}.lst-kix_7gtwvv8lds0h-1>li:before{content:"- "}.lst-kix_7gtwvv8lds0h-0>li:before{content:"- "}ol.lst-kix_thuqgp6gfs8h-1.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-1 0}ol.lst-kix_f28qers2ka94-8.start{counter-reset:lst-ctn-kix_f28qers2ka94-8 0}.lst-kix_t4et3tnq1pzp-4>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-0>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-0,decimal) ". "}.lst-kix_thuqgp6gfs8h-1>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-1,lower-latin) ". "}.lst-kix_f38l0ecznhb0-6>li:before{content:"- "}.lst-kix_f38l0ecznhb0-7>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-3>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-5>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-2>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-2,lower-roman) ". "}.lst-kix_thuqgp6gfs8h-3>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-3,decimal) ". "}.lst-kix_t4et3tnq1pzp-0>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-8>li:before{content:"- "}.lst-kix_f28qers2ka94-7>li{counter-increment:lst-ctn-kix_f28qers2ka94-7}.lst-kix_f38l0ecznhb0-3>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-1>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-2>li:before{content:"- "}.lst-kix_f28qers2ka94-1>li{counter-increment:lst-ctn-kix_f28qers2ka94-1}.lst-kix_f38l0ecznhb0-4>li:before{content:"- "}.lst-kix_f38l0ecznhb0-5>li:before{content:"- "}.lst-kix_f38l0ecznhb0-8>li:before{content:"- "}ul.lst-kix_7gtwvv8lds0h-0{list-style-type:none}ul.lst-kix_7gtwvv8lds0h-1{list-style-type:none}.lst-kix_lw3zh1qbhlji-1>li:before{content:"\0025cb "}ul.lst-kix_7gtwvv8lds0h-2{list-style-type:none}.lst-kix_lw3zh1qbhlji-2>li:before{content:"\0025a0 "}ul.lst-kix_7gtwvv8lds0h-7{list-style-type:none}.lst-kix_thuqgp6gfs8h-8>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-8,lower-roman) ". "}ul.lst-kix_7gtwvv8lds0h-8{list-style-type:none}.lst-kix_lw3zh1qbhlji-3>li:before{content:"\0025cf "}.lst-kix_lw3zh1qbhlji-5>li:before{content:"\0025a0 "}ul.lst-kix_7gtwvv8lds0h-3{list-style-type:none}.lst-kix_thuqgp6gfs8h-6>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-6,decimal) ". "}.lst-kix_thuqgp6gfs8h-7>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-7,lower-latin) ". "}ul.lst-kix_7gtwvv8lds0h-4{list-style-type:none}ul.lst-kix_7gtwvv8lds0h-5{list-style-type:none}.lst-kix_lw3zh1qbhlji-4>li:before{content:"\0025cb "}ul.lst-kix_7gtwvv8lds0h-6{list-style-type:none}.lst-kix_thuqgp6gfs8h-4>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-4,lower-latin) ". "}.lst-kix_thuqgp6gfs8h-5>li:before{content:"" counter(lst-ctn-kix_thuqgp6gfs8h-5,lower-roman) ". "}.lst-kix_f38l0ecznhb0-2>li:before{content:"- "}.lst-kix_t4et3tnq1pzp-7>li:before{content:"- "}.lst-kix_lw3zh1qbhlji-7>li:before{content:"\0025cb "}.lst-kix_t4et3tnq1pzp-6>li:before{content:"- "}.lst-kix_f38l0ecznhb0-0>li:before{content:"- "}.lst-kix_f38l0ecznhb0-1>li:before{content:"- "}.lst-kix_lw3zh1qbhlji-6>li:before{content:"\0025cf "}.lst-kix_c52otkrerajb-8>li:before{content:"- "}.lst-kix_c52otkrerajb-6>li:before{content:"- "}.lst-kix_b2z7bfhnik92-0>li:before{content:"- "}.lst-kix_lw3zh1qbhlji-8>li:before{content:"\0025a0 "}ol.lst-kix_thuqgp6gfs8h-2.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-2 0}.lst-kix_b2z7bfhnik92-2>li:before{content:"- "}.lst-kix_tjxel15w0vnb-1>li:before{content:"\0025cb "}.lst-kix_f28qers2ka94-0>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-0,decimal) ". "}.lst-kix_c52otkrerajb-0>li:before{content:"- "}.lst-kix_b2z7bfhnik92-6>li:before{content:"- "}ol.lst-kix_f28qers2ka94-7.start{counter-reset:lst-ctn-kix_f28qers2ka94-7 0}.lst-kix_c52otkrerajb-2>li:before{content:"- "}.lst-kix_b2z7bfhnik92-4>li:before{content:"- "}.lst-kix_b2z7bfhnik92-8>li:before{content:"- "}.lst-kix_thuqgp6gfs8h-8>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-8}.lst-kix_c52otkrerajb-4>li:before{content:"- "}ul.lst-kix_f38l0ecznhb0-8{list-style-type:none}ul.lst-kix_f38l0ecznhb0-6{list-style-type:none}ul.lst-kix_f38l0ecznhb0-7{list-style-type:none}ul.lst-kix_f38l0ecznhb0-4{list-style-type:none}ul.lst-kix_f38l0ecznhb0-5{list-style-type:none}ul.lst-kix_f38l0ecznhb0-2{list-style-type:none}ul.lst-kix_f38l0ecznhb0-3{list-style-type:none}ul.lst-kix_f38l0ecznhb0-0{list-style-type:none}ul.lst-kix_f38l0ecznhb0-1{list-style-type:none}.lst-kix_thuqgp6gfs8h-7>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-7}ol.lst-kix_thuqgp6gfs8h-0.start{counter-reset:lst-ctn-kix_thuqgp6gfs8h-0 0}.lst-kix_thuqgp6gfs8h-1>li{counter-increment:lst-ctn-kix_thuqgp6gfs8h-1}.lst-kix_7gtwvv8lds0h-3>li:before{content:"- "}.lst-kix_7gtwvv8lds0h-5>li:before{content:"- "}.lst-kix_tjxel15w0vnb-7>li:before{content:"\0025cb "}.lst-kix_f28qers2ka94-8>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-8,lower-roman) ". "}.lst-kix_7gtwvv8lds0h-7>li:before{content:"- "}.lst-kix_f28qers2ka94-3>li{counter-increment:lst-ctn-kix_f28qers2ka94-3}.lst-kix_tjxel15w0vnb-3>li:before{content:"\0025cf "}.lst-kix_tjxel15w0vnb-5>li:before{content:"\0025a0 "}.lst-kix_f28qers2ka94-2>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-2,lower-roman) ". "}.lst-kix_f28qers2ka94-6>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-6,decimal) ". "}.lst-kix_f28qers2ka94-4>li:before{content:"" counter(lst-ctn-kix_f28qers2ka94-4,lower-latin) ". "}ol{margin:0;padding:0}table td,table th{padding:0}.c16{padding-top:0pt;padding-bottom:0pt;line-height:1.25;orphans:2;widows:2;text-align:left;height:11pt}.c13{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:16pt;font-family:"Arial";font-style:normal}.c2{background-color:#ffffff;padding-top:18pt;padding-bottom:6pt;line-height:1.38;orphans:2;widows:2;text-align:left}.c0{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c5{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c6{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c17{padding-top:0pt;padding-bottom:0pt;line-height:1.25;orphans:2;widows:2;text-align:left}.c7{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c12{color:#000000;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c14{color:#000000;text-decoration:none;vertical-align:baseline;font-size:11pt;font-style:normal}.c18{font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial"}.c9{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c10{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c1{color:inherit;text-decoration:inherit}.c8{font-weight:400;font-family:"Courier New"}.c3{background-color:#ffffff;color:#545454}.c11{background-color:#ffffff;font-style:italic}.c4{font-weight:700}.c15{font-style:italic}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}}This is part 4 of a 6-part series detailing a set of vulnerabilities found by Project Zero being exploited in the wild. To read the other parts of the series, see the introduction post.

Written by Brandon Azad, when working at Project Zero