Respect 🫡
A lot of speculation on if KVM bugs have gotten cheaper, and why id do it for 50k instead of a milly. I wasn't born yesterday. I know I couldve sold it for waayy more. I didnt want to. I did it for the love of the game. I wanted to know if I could do it, and now we know i can. r?
0
0
30
2,288
Lan Vu retweeted
Very powerful bug. In the past, we also submitted few one-shot to Chrome GPU via ANGLE ( but before 250k era 🥲).
This report may include the trick for escaping from the GPU to the CPU ( but i guess too easy for AI atm )
Looking forward the details when the bug is de-restricted.
This report may include the trick for escaping from the GPU to the CPU ( but i guess too easy for AI atm )
Looking forward the details when the bug is de-restricted.
3
7
73
10,388
Cứ khóc đi khóc đi, đừng ngại ngùng 🤧
The released firefox 150.0.3 today has killed our renderer exploit component, since only 1 day left we have no choice but withdrawal our entry.Kudos to our teammate @trichimtrich , @lanleft_ and @wiz1340 for their hard works that created 2 fullchains work flawlessly from firefox ) but was being killed one week and 1 day before the event
Good luck for the rest of participants!
And thanks everyone for wishing us luck 🙏
Like usual, we will share writeup in future when the affected version is irrelevant, Cheers!
4
2
72
7,579
Lan Vu retweeted
We’ve been through all kinds of situations: exploits failing, vendors turning off services during demos, patches being released the night before a demo, and more but we happily accepted and continue to play.
And if you don’t participate in the game, who cares about your opinion?
And if you don’t participate in the game, who cares about your opinion?
0
5
34
4,617
Lan Vu retweeted
Firefox x Mythos fixed 423 bugs in April. They released stable 150.0.2!
youtu.be/exkq427zKRU?si… via @YouTube
youtu.be/exkq427zKRU?si… via @YouTube
0
3
23
16,346
Lan Vu retweeted
Despite 271 bugs massacred by Anthropic, our renderer rce and sbx escape alive and well ready unless there is sudden patch before p2o ( mean we dont have enough time for prepare new one ) - wish us luck!
blog.mozilla.org/en/privacy-sec…
blog.mozilla.org/en/privacy-sec…
15
50
369
77,495
Lan Vu retweeted
Have Anthropic killed all the Firefish?
0c10b84aa1e72c46319c9a6b4dff5801 : exploit_browser.html just in case patched before p2o 😂
0c10b84aa1e72c46319c9a6b4dff5801 : exploit_browser.html just in case patched before p2o 😂
0
13
192
33,660
Lan Vu retweeted
Technical details on exploiting Firefox 0day we found last year by AI-assisted fuzzing.
by @lanleft_
qriousec.github.io/post/cve-2025-…
by @lanleft_
qriousec.github.io/post/cve-2025-…
Double Kill 🤪 Mozilla team working on the patch, we developing the exploit, no drama needed 😎
0
33
148
20,311
Lan Vu retweeted
Not a single LLM can correctly explain the root cause even given the crash poc of this bug, let alone talk about how to write the exploit code. Kudo @lanleft_ for her great works!
We may publish writeup when it no longer hot.
We may publish writeup when it no longer hot.
@lanleft_ has convinced firefox GC to give her a shell 🤪
3
2
93
9,855
Lan Vu retweeted
Last month, I gave a talk at @POC_Crew about ATLANTIS and the tech behind our #AIxCC win.
We dove into competition details, using LLMs for deep bug discovery, and what's next for AI in security.
github.com/pr0cf5/talks/b…
We dove into competition details, using LLMs for deep bug discovery, and what's next for AI in security.
github.com/pr0cf5/talks/b…
0
19
87
6,785
Lan Vu retweeted
A quick review theses Chrome libAngle issues found by Big Sleep likely from fuzzer output more than AI reasoning, 1 or 2 issues even not exploitable because of libc++ mitigation enabled by default in Chrome.
issuetracker.google.com/issues?q=%20co…
The fuzzer still producing many crashes:
issues.chromium.org/issues?q=angle…
issuetracker.google.com/issues?q=%20co…
The fuzzer still producing many crashes:
issues.chromium.org/issues?q=angle…
2
3
33
3,920
Can not get a cve from this vulnerability, it’s quite sad 😞
By the way, I’d like to give a huge thanks to my mentor @__suto 😊
By the way, I’d like to give a huge thanks to my mentor @__suto 😊
Check out our newest blog about how we took advantage of a WebGPU feature to turn an integer underflow bug into an arbitrary read in Chrome’s WebGPU. This bug was fixed by Google long ago, but our ticket is still restricted.
qriousec.github.io/post/oob-angle/
by @lanleft_ + @__suto
0
3
35
5,815
Lan Vu retweeted
If you like Chrome IPC shenanigans like this, you might also enjoy my talk from black hat 25: youtu.be/qhhJCLy0YBA?si…
Whoah... $250000
(CVE-2025-4609, similar to CVE-2025-2783/412578726)[412578726][Mojo][IpczDriver]ipcz bug -> renderer duplicate browser process handle -> escape sbx is now open with PoC & exploit(success rate is nearly 70%-80%)
issues.chromium.org/issues/4125787…
issues.chromium.org/issues/4125787…
3
35
227
38,032
Lan Vu retweeted
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectz…
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
2
71
291
25,015