Long time listener, infrequent tweeter. Head of Exploitation and Offensive Research at Google. Views are my own.
Joined October 2012
- Tweets 91
- Following 201
- Followers 4,560
- Likes 233
5 Photos and videos
Tim Willis retweeted
12 Aug 2025
Some personal news: I'm thrilled to be moving back to Project Zero! Specifically I'll be joining the Big Sleep project to find vulnerabilities in JavaScript engines. We've already found and reported our first vulnerability in V8 last week: issuetracker.google.com/issu…
6
36
421
34,117
Tim Willis retweeted
12 Aug 2025
If you've been keeping track on the Big Sleep bug tracker at goo.gle/bigsleep you might have noticed it lists more bugs now compared to last week. Including a "High impact issue in V8" :)
3
20
101
23,161
8 Aug 2025
That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes)
googleprojectzero.blogspot.c…
48
130
24,120
Tim Willis retweeted
29 Jul 2025
Today @Google Project Zero announced a new trial policy: Reporting Transparency. We’ll now share when we report a security vuln to a vendor within 1 week including products deadlines. Goal: shrink the patch gap drive faster, safer updates for users: googleprojectzero.blogspot.c…
25
73
14,337
29 Jul 2025
Great to see this live!
Let's see how the trial pans out 🍿👀
29 Jul 2025
While most vendors ship timely patches for vulnerabilities reported by Project Zero, they don’t always reach users. Today, we’re announcing Reporting Transparency, a new policy to encourage downstream fixes
googleprojectzero.blogspot.c…
1
2
12
1,846
25 May 2025
Part 7 (!) of @j00ru's Windows Registry adventure is now live:
googleprojectzero.blogspot.c…
"I will describe the various areas that are important in the context of low-level security research... all possible entry points to attack the registry... and the primitives they generate"🙌
5
17
1,335
9 May 2025
For those that won't be in Germany next weekend to see @dillon_franke live, this is the next best thing!
(post also includes Dillon's fuzzing harness and tools Dillon built along the way) 🎉
9 May 2025
Thrilled to announce my new Project Zero blog post is LIVE! 🎉 I detail my knowledge-driven fuzzing process to find sandbox escape vulnerabilities in CoreAudio on MacOS.
I'll talk about this and the exploitation process next week @offensive_con!
googleprojectzero.blogspot.c…
1
15
1,866
16 Apr 2025
...and now, introducing Part 6 of @j00ru's work on the Windows Registry:
googleprojectzero.blogspot.c…
📖👀
19 Dec 2024
Part 5 of @j00ru's Windows Registry Adventure is out!
googleprojectzero.blogspot.c…
Incredible depth of knowledge on display, and good to see it shared as a reference with the world ❤️
1
21
68
10,101
30 Jan 2025
Two new posts from @tiraniddo today:
googleprojectzero.blogspot.c… on reviving a memory trapping primitive from his 2021 post.
googleprojectzero.blogspot.c… where he shares a bug class and demonstrates how you can get a COM object trapped in a more privileged process.
Happy Reading! 📚
97
225
33,007
7 Jan 2025
It doesn't happen very often, but Project Zero is hiring!
goo.gle/41DBQBY
Please share with anyone you think would be awesome for the role 🎉
Looking for at least one person. DMs open if you want to reach out about the role.
The team: youtu.be/My_13FXODdU
4
94
267
49,227
19 Dec 2024
Part 5 of @j00ru's Windows Registry Adventure is out!
googleprojectzero.blogspot.c…
Incredible depth of knowledge on display, and good to see it shared as a reference with the world ❤️
45
117
23,717
Tim Willis retweeted
17 Dec 2024
Great to see Apple quickly patch the MacOS sandbox escape/privilege escalation vulnerability I reported to them. Big thanks to @NedWilliamson, @i41nbeer, and @i41nbeer for all the help :) I'm working on a blog post and hope to release it soon!!
10
26
164
20,826
Tim Willis retweeted
16 Dec 2024
My blog post is now live alongside @amnesty 's joint release, providing remarkable insight into an ITW exploitation campaign!
googleprojectzero.blogspot.c…
Turns out that you can find out quite a bit with just some kernel stacktraces ;)
From Amnesty:
securitylab.amnesty.org/late…
2
41
106
32,553
16 Dec 2024
If you've ever wondered if one can determine a vuln from just the kernel panic logs, @__sethJenkins (feat. @tehjh & @benoitsevens) have something to share: googleprojectzero.blogspot.c…
Great to collaborate with @amnesty, find vulns and get them fixed: securitylab.amnesty.org/late…
11
38
7,980
12 Dec 2024
Finding 0day is not the most impactful thing that Project Zero does 😲 — it's sharing knowledge 🧠. One part of that sharing is our tooling work to help other devs and reserachers.
Today's installment, @tiraniddo's updated OleView.NET👍
Blog: googleprojectzero.blogspot.c…
2
34
153
15,784
1 Nov 2024
Project Zero Blogpost recap for the month:
googleprojectzero.blogspot.c… — @j00ru doing another deep dive into the Windows Registry
googleprojectzero.blogspot.c… — Nick Galloway's dav1d fuzzing case study
(new) googleprojectzero.blogspot.c… — an update on using LLMs to find vulns
Enjoy! 🎉
3
60
205
20,073
13 Jun 2024
"While... public and in-the-wild research on Android GPU drivers [exists], other chipset components may not be as frequently audited so this research sought to explore those drivers in greater detail."
Hot tip: There's a video version and a proof of concept exploit at the end👍
13 Jun 2024
My new Project Zero blog post, Driving Forward in Android Drivers is live! 🥳
googleprojectzero.blogspot.c…
1
3
13
4,038
18 Apr 2024
Join @j00ru as he shares his research/adventure through the Windows Registry:
googleprojectzero.blogspot.c…
50 CVEs is just the beginning. Future posts will explore the attack surface, history, practical exploitation using hive memory corruption, cell indexes and other good times🎉
1
86
160
43,060
6 Feb 2024
Great to see srldf.org working as intended!
This fund would have never launched without the hard work of many, but a special shoutout to @HarleyGeiger and @charley_snyder_ to making srldf.org a reality.
4 Feb 2024
Shout out to the Security Research Legal Defense Fund for helping us go public about our train research! We're honored to be their first grantees.
Longer post link to their announcement: social.hackerspace.pl/@q3k/1…
4
9
2,054
3 Nov 2023
New Project Zero blogpost by Mark Brand - first mobile device ships with MTE (and how to enable it).
"MTE on a production handset for the first time is a big step forward... there's real potential to use this technology to make 0-day harder".
googleprojectzero.blogspot.c…
2
72
187
53,931