Security @Google; @FluxFingers/@Sauercl0ud; previously V8 Security, Intern {Project Zero, @XI_Research}. Personal account. rwx.page on Bluesky.
Joined May 2014
- Tweets 316
- Following 722
- Followers 1,116
- Likes 1,024
Photos and videos
#Zer0Con2026 - SPEAKER 🎃
Pumpkin Chang(@u1f383) from DEVCORE - “Modern Android Kernel Exploitation Through a Mali Driver Vulnerability”
For more: zer0con.org
15
118
5,139
#Zer0Con2026 - SPEAKER 🌌
Brendon Tiszka from Google Project Zero - “Researcher’s Guide to the Galaxy: Digging into Samsung 0-click, Android Messengers, DNG, and other image formats”
For more: zer0con.org
5
58
3,122
Carl Smith retweeted
29 Oct 2025
We derestricted crbug.com/382005099 today which might just be my favorite bug of the last few years: bad interaction between WebAudio changing the CPU's handling of floats and V8 not expecting that. See crbug.com/382005099#comment1… for a PoC exploit. Also affected other browsers
4
48
246
22,566
Carl Smith retweeted
25 Oct 2025
I'm pretty excited about this (POE2 in particular)! It's basically what we've been preparing for with the PKEY-based hardware sandboxing prototype for V8 (docs.google.com/document/d/1…)
24 Oct 2025
More HW security goodness from Arm:
community.arm.com/arm-commun…
vMTE (Virtual Memory Tagging) allows to use MTE in a more flexible way, consuming less RAM.
POE2 allows to build efficient in-process sandboxes and isolation. More-or-less improvement over x86 Memory Protection Keys.
9
60
13,520
If you like Chrome IPC shenanigans like this, you might also enjoy my talk from black hat 25: youtu.be/qhhJCLy0YBA?si=qLz2…
Whoah... $250000
(CVE-2025-4609, similar to CVE-2025-2783/412578726)[412578726][Mojo][IpczDriver]ipcz bug -> renderer duplicate browser process handle -> escape sbx is now open with PoC & exploit(success rate is nearly 70%-80%)
issues.chromium.org/issues/4…
issues.chromium.org/issues/4…
3
34
227
37,693
Carl Smith retweeted
8 Aug 2025
That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes)
googleprojectzero.blogspot.c…
48
130
24,122
Carl Smith retweeted
1 Aug 2025
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectzero…
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
2
72
293
24,720
Carl Smith retweeted
9 Jul 2025
If you have a machine with PKEY support and recent Linux kernel you can now play around with hardware support for the V8 sandbox. When active, JS Wasm code has no write permissions outside the sandbox address space. To enable, set `v8_enable_sandbox_hardware_support = true`.
3
17
77
11,514
Carl Smith retweeted
3 Jun 2025
I've also updated our V8 Exploit Tracker sheet now: docs.google.com/document/d/1… (see the 2025 tab) :)
1
14
70
4,533
Carl Smith retweeted
16 Apr 2025
...and now, introducing Part 6 of @j00ru's work on the Windows Registry:
googleprojectzero.blogspot.c…
📖👀
19 Dec 2024
Part 5 of @j00ru's Windows Registry Adventure is out!
googleprojectzero.blogspot.c…
Incredible depth of knowledge on display, and good to see it shared as a reference with the world ❤️
1
21
68
10,101
My writeup of the 2023 NSO in-the-wild iOS zero-click BLASTDOOR webp exploit: Blasting Past Webp -
googleprojectzero.blogspot.c…
21
234
708
86,598
Senior Software Engineer, V8 Bug Detection: google.com/about/careers/app…
Software Engineer II, V8 Bug Detection:
google.com/about/careers/app…
6
21
3,808
Carl Smith retweeted
26 Feb 2025
I tweeted before about the Apple CoreAudio issues found by Google TAG. Well, the fuzz harness used to find these issues is now included in Jackalope examples, see github.com/googleprojectzero… . Happy fuzzing! :)
28 Jan 2025
The latest Apple security update contains fixes for three CoreAudio issues (CVE-2025-24160, CVE-2025-24161, CVE-2025-24163). These were found by Google Threat Analysis Group using Jackalope fuzzer.
2
39
182
30,285
Carl Smith retweeted
20 Feb 2025
Congratulations to Carl Smith from v8 Security team and join Blackhat USA review board as guest reviewer. He is willing to share, and an open-minded, hardcore researcher and developer.
@cffsmith
@BlackHatEvents
2
27
1,403
4 Feb 2025
I’m very excited to announce that we at V8 Security have finally published our first version of Fuzzilli that understands Wasm!
Go check it out at github.com/googleprojectzero….
While we still have a way to go in improving it, we think it shows a promising approach!
15
109
473
37,796
4 Feb 2025
Some slides discussing some of this work can be found here:
powerofcommunity.net/poc2024…
1
1
7
1,448
meow meow meow meow meow meowwww
241
4,718
28,833
1,061,611
"Invariant inversion" in memory-unsafe languages
pacibsp.github.io/2024/invar…
2
21
66
9,668