[CVE-2015-0093] Enabling QR codes in Internet Explorer, or a story of a cross-platform memory disclosure

A Google Project Zero post that walks through developing a reliable exploit for an Adobe Reader font vulnerability to achieve remote code execution.

Disclosure of multiple internet-to-baseband remote code execution vulnerabilities affecting Samsung Exynos modems, detailing the flaws, affected devices, and patch availability.

By James Forshaw, Project Zero In my previous blog post I discussed an issue with the Windows Kernel’s handling of Restricted Tokens which allowed me to escape the Chrome GPU sandbox. Originally I’d planned to use Firefox for the proof-of-concept as Firefox uses the same effective sandbox level as the Chrome GPU process for its content renderers. That means a FF content RCE would give code execution in a sandbox where you could abuse the Windows Kernel Restricted Tokens issue, making it much more serious.

The first part of the series provides an in-depth discussion of the vulnerability, the second part presents a technique to remotely break ASLR, and the third part explains how to gain remote code execution afterwards.

A Google Project Zero post detailing exploitation of CVE-2014-6350 to escape Internet Explorer's Enhanced Protected Mode sandbox.

Final part of the N-day chain series: how CVE-2023-36802, a type-confusion flaw in the mskssrv.sys driver, was analysed and exploited to raise VMware privileges to SYSTEM on the host.