-
When Sorting Leads To Confusion
In this blogpost I will discuss a chrome 0 day I found and reported in early August 2026 (CVE-2026-85046), a v8 bug in the compilers that leads to an array containing PACKED_ELEMENTS to receive the map PACKED_SMI_ELEMENTS, this…
-
From Regex to RCE
In this blogpost I will discuss a chrome 0 day I found and reported in July 2026, CVE-2026-15776, a bug in v8 that leads to UAF on the js heap. I chained this bug with an n-day sandbox…
-
A Ghost in Turboshaft’s Store Elimination
This is my personal take at the cve CVE-2025-5419, a bug in the store-store elimination phase of the turboshaft compiler that leads to rce.
-
Lua.efi
Secure Boot you say? Lua running as a uefi application you say?? What about some Secure Boot war crimes??? Challenge: Lua.efi (uiuctf 2025) Oh hello there! This is a write-up for Lua.efi, a UEFI challenge from UIUCTF 2025 that I and…
-
Triwizard Maze
Challenge: Triwizard Maze (CCIT 2024 Local Finals) TL;DR: Diving into the Triwizard Tournament with a Depth First Search through a folder maze using multiple ROP chains. Hold onto your wands, witches and wizards! 🪄 This Harry Potter-themed challenge,…
-
The Wilderness
HEY YOU! Tired of the chaos caused by memory mappings landing just about anywhere?😤 Today, we’re turning the tables on ASLR with a WILD cache timing attack! Challenge: The_wilderness (openECSC 2024 round 2) Attack Type: Timing memory accesses…
-
Linecrosser
Welcome to the thrilling tale of how a seemingly insignificant oversight led me on a wild ride through the world of stack pivoting with mathematical precision. Challenge: Linecrosser (openECSC 2024 round 1) Attack Type: Ret-to-libc, achieved by stack…