Security researcher at Google Project Zero. Tweets are my own.
Backup @ifsecure@infosec.exchange
May 8, 2019 • 5 tweets • 2 min read
A more serious take on this: What makes me sad is (once again) undermining end-user security to the benefit of corporate dinosaurs who can't be bothered to adapt. The IE Compat View certainly has a long history of abuse, but let's also take a look at some other examples: (1/4)
In 2017 MS disabled VBScript in IE, but left it running in Intranet and Trusted Sites zones for the benefit of said dinosaurs still using it. Guess what? By leaving it in, it could be abused from Internet zone as well: bugs.chromium.org/p/project-zero… and bugs.chromium.org/p/project-zero… (2/4)
Aug 28, 2018 • 5 tweets • 2 min read
bugs.chromium.org/p/project-zero… is another JScsript issue (like 1506) where a JScsript variable (Note: a variable itself, not a backing object) is not properly tracked by a garbage collector. This type of issues is interesting for 2 reasons:
1. These bugs are very difficult to find by fuzzing because an entire block of variables needs to get freed to observe a crash. We did find it by fuzzing, but only after a pretty large amount of iterations.
