she/her | coffee delivery at Qrious Secure @qriousec |
Joined September 2019
- Tweets 107
- Following 494
- Followers 1,593
- Likes 1,335
4 Photos and videos
May 12
Cแปฉ khรณc ฤi khรณc ฤi, ฤแปซng ngแบกi ngรนng ๐คง
May 12
The released firefox 150.0.3 today has killed our renderer exploit component, since only 1 day left we have no choice but withdrawal our entry.Kudos to our teammate @trichimtrich , @lanleft_ and @wiz1340 for their hard works that created 2 fullchains work flawlessly from firefox 147-150.0.2 ( 4m alive) but was being killed one week and 1 day before the event
Good luck for the rest of participants!
And thanks everyone for wishing us luck ๐
Like usual, we will share writeup in future when the affected version is irrelevant, Cheers!
4
2
69
6,860
Lan Vu ๐ป๐ณ retweeted
May 11
Weโve been through all kinds of situations: exploits failing, vendors turning off services during demos, patches being released the night before a demo, and more but we happily accepted and continue to play.
And if you donโt participate in the game, who cares about your opinion?
5
35
4,232
Lan Vu ๐ป๐ณ retweeted
May 8
Firefox x Mythos fixed 423 bugs in April. They released stable 150.0.2!
youtu.be/exkq427zKRU?si=VN6Hโฆ via @YouTube
3
24
15,990
Lan Vu ๐ป๐ณ retweeted
Apr 22
Despite 271 bugs massacred by Anthropic, our renderer rce and sbx escape alive and well ready unless there is sudden patch before p2o ( mean we dont have enough time for prepare new one ) - wish us luck!
blog.mozilla.org/en/privacy-โฆ
15
50
372
76,993
Lan Vu ๐ป๐ณ retweeted
Apr 4
Have Anthropic killed all the Firefish?
0c10b84aa1e72c46319c9a6b4dff5801 : exploit_browser.html just in case patched before p2o ๐
13
193
33,010
Mar 28
Check out my latest blog post. I hope you all enjoy it
๐๐
qriousec.github.io/post/cve-โฆ
5
47
248
15,979
Lan Vu ๐ป๐ณ retweeted
Mar 28
Technical details on exploiting Firefox 0day we found last year by AI-assisted fuzzing.
by @lanleft_
qriousec.github.io/post/cve-โฆ
4 Nov 2025
Double Kill ๐คช Mozilla team working on the patch, we developing the exploit, no drama needed ๐
33
151
20,006
Not a single LLM can correctly explain the root cause even given the crash poc of this bug, let alone talk about how to write the exploit code. Kudo @lanleft_ for her great works!
We may publish writeup when it no longer hot.
3
2
94
9,801
10 Dec 2025
ah ha, I made it โบ๏ธ
1
50
3,100
Last month, I gave a talk at @POC_Crew about ATLANTIS and the tech behind our #AIxCC win.
We dove into competition details, using LLMs for deep bug discovery, and what's next for AI in security.
github.com/pr0cf5/talks/blobโฆ
19
87
6,740
Lan Vu ๐ป๐ณ retweeted
28 Nov 2025
2025 is 91% complete.
24
726
3,680
108,649
A quick review theses Chrome libAngle issues found by Big Sleep likely from fuzzer output more than AI reasoning, 1 or 2 issues even not exploitable because of libc mitigation enabled by default in Chrome.
issuetracker.google.com/issuโฆ
The fuzzer still producing many crashes:
issues.chromium.org/issues?qโฆ
2
3
33
3,886
10 Sep 2025
Can not get a cve from this vulnerability, itโs quite sad ๐
By the way, Iโd like to give a huge thanks to my mentor @__suto ๐
10 Sep 2025
Check out our newest blog about how we took advantage of a WebGPU feature to turn an integer underflow bug into an arbitrary read in Chromeโs WebGPU. This bug was fixed by Google long ago, but our ticket is still restricted.
qriousec.github.io/post/oob-โฆ
by @lanleft_ @__suto
3
37
5,694
If you like Chrome IPC shenanigans like this, you might also enjoy my talk from black hat 25: youtu.be/qhhJCLy0YBA?si=qLz2โฆ
Whoah... $250000
(CVE-2025-4609, similar to CVE-2025-2783/412578726)[412578726][Mojo][IpczDriver]ipcz bug -> renderer duplicate browser process handle -> escape sbx is now open with PoC & exploit(success rate is nearly 70%-80%)
issues.chromium.org/issues/4โฆ
issues.chromium.org/issues/4โฆ
3
34
227
37,693
Lan Vu ๐ป๐ณ retweeted
1 Aug 2025
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectzeroโฆ
It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
2
72
293
24,719
Lan Vu ๐ป๐ณ retweeted
8 May 2025
Singapore - shout it out for Yuki Chen ๐คฉ !!! Bringing Day 1 of @offbyoneconf 2025 to a explosive end with ๐ ๐๐จ๐ฎ๐ซ๐ง๐๐ฒ ๐ข๐ง๐ญ๐จ ๐๐ข๐ง๐๐จ๐ฐ๐ฌ ๐๐๐๐ฎ๐ซ๐ข๐ญ๐ฒ ๐๐ฎ๐ฉ๐ฉ๐จ๐ซ๐ญ ๐๐ซ๐จ๐ฏ๐ข๐๐๐ซ ๐๐ง๐ญ๐๐ซ๐๐๐๐.
๐๐๐
9
5
37
12,235
Lan Vu ๐ป๐ณ retweeted
9 Jan 2025
A brief JavascriptCore RCE story by @lanleft_ and An Nguyแป
n
qriousec.github.io/post/jsc-โฆ
56
225
20,541