Project Zero Bugs@ProjectZeroBugs

A bot that posts the latest blog posts and disclosures from Google's Project Zero

bugs.chromium.org/p/project-…
Joined February 2016
Windows Exploitation Techniques: Dangling COM Object Registrations projectzero.google/2026/09/w…

Windows Exploitation Techniques: Dangling COM Object Registrations

This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in...

projectzero.google
47
216
20,754
Windows: CrossDevice Dangling COM Registration Incomplete Fix EoP project-zero.issues.chromium…
1
6
20
4,123
Testing race conditions with memory access tracing and stack-based delay injection projectzero.google/2026/09/m…

Testing race conditions with memory access tracing and stack-based delay injection

Many security bugs are race conditions, where multi-threaded execution has to occur with the righ...

projectzero.google
1
13
73
6,773
PowerVR: PVRSRV_MEMALLOCFLAG_OS_LINUX_PREFER_CMA PMR allocations with a large page size causes page allocator corruption project-zero.issues.chromium…
4
23
5,301
Linux: fork() failure path tries to clean up BPF task storage that was never initialized, leading to UAF project-zero.issues.chromium…
6
61
6,507
aoc: Type Confusion in aoc_unlocked_ioctl_handle_ion_fd project-zero.issues.chromium…
2
8
4,440
LWIS kernel driver OOB write in lwis_io_buffer_write project-zero.issues.chromium…
3
17
4,474
fuse: uninitialized folio read via FUSE_NOTIFY_RETRIEVE on !uptodate pages project-zero.issues.chromium…
1
7
3,881
Linux 7.0: vfs_open_tree(OPEN_TREE_NAMESPACE) accepts regular files, so cwd can be a regular file project-zero.issues.chromium…
1
12
5,246
Pixel Codec3P VPU driver: lifetime issues with fw_debug_buf project-zero.issues.chromium…
7
3,848
Adobe DNG SDK: heap buffer overflow in DecodeFPDelta due to missing pixel format validation and non-fatal error handling for semantic mask IFDs project-zero.issues.chromium…
2
3
3,065
Adobe DNG SDK: Heap memory disclosure via uninitialized MCU buffer in Hasselblad 3FR lossless JPEG decode path project-zero.issues.chromium…
7
3,346
Adobe DNG SDK: Heap memory disclosure via LZW-compressed semantic masks rendered through MaskedRGBTables project-zero.issues.chromium…
1
3
2,976
Adobe DNG SDK: Heap memory disclosure in ReorderSubTileBlocks due to truncated row block count for clipped strips project-zero.issues.chromium…
1
7
3,525
PowerVR: virtual/physical unit confusion in DevmemIntComputeVirtualIndicesFromLogical() leads to OOB kernel write project-zero.issues.chromium…
6
26
14,977
PowerVR: _MMU_AllocLevel() error recovery paths leave dangling page table entries project-zero.issues.chromium…
5
18
4,705
PowerVR: kernel<->fw CCB contains SYNC_PRIMITIVE_BLOCK firmware address without holding reference project-zero.issues.chromium…
2
8
3,572
Pixel GXP: unsafe set_page_dirty() in gcip_iommu_mapping_buffer_flush_sgt() project-zero.issues.chromium…
3
24
3,771
libheif: Heap-based Buffer Overflow in Uncompressed Image Tiled Decoding project-zero.issues.chromium…
3
27
4,939
CPIF driver: link_read_gnss_image and link_load_gnss_image lead to kernel OOB read and write from userland project-zero.issues.chromium…
1
9
3,109
Load more