vulnerability research

research

In my spare time, I enjoy the challenge of finding security vulnerabilities and responsibly reporting them. I've discovered and responsibly disclosed High- and Critical-severity vulnerabilities in Google Chrome, Android, macOS, Samsung Galaxy phones, TikTok, and dozens of other companies. Some of the most interesting and impactful work is memory safety in large C and C++ codebases.

recent security advisories

CVE	Severity	Component	Overview
CVE-2026-110142 Google Chrome VRP	Medium	Use-after-free in FileSystem	Chrome's FileSystem code kept using memory after it had been freed. Same component as the June one.
CVE-2026-59618 Android VRP	Moderate	Out-of-bounds read in Pixel JPEG (SMFC)	The Pixel's hardware JPEG encoder could be made to read past the frame it was given and hand those bytes back inside a JPEG.
CVE-2026-102299 Google Chrome VRP	High	Type confusion in V8 (Turboshaft)	The V8 optimizing compiler had a logic bug where it returned the wrong number.
CVE-2026-95339 Google Chrome VRP	Critical	Use-after-free in ServiceWorker (browser process)	Browser-process use-after-free. A loop kept walking a list that had been reallocated underneath it, in ServiceWorker code.
CoreUI: a heap bug in macOS asset decoding Apple Security Bounty	not rated	Heap corruption in CoreUI	Heap corruption while macOS decodes a compiled asset catalog, the format behind app icons and interface artwork.
CVE-2026-21094 Samsung Mobile Security Rewards Program	High	Out-of-bounds write in wpa_supplicant	The Wi-Fi daemon on Galaxy phones trusted a frame from the air and wrote past the end of a buffer.
CVE-2026-58750 Android VRP	High	Use-after-free in Pixel LWIS (kernel)	A use-after-free in the Pixel kernel's imaging driver.
CVE-2026-10886 Google Chrome VRP	Critical	Use-after-free in FileSystem	Browser-process use-after-free. Closing an incognito window freed a file-system watcher that a queued callback still pointed at.