Xion (@0x10n) / X

Xion

373 posts

Xion

@0x10n

CMU CSD PhD student | '24/'25 Top#0 Chrome Researcher | P2O Vancouver '24, TyphoonPWN '24/'25, DEFCON CTF 31-33, ... | PPP, KAIST GoN '18, @zer0pts

Pittsburgh, PA

Joined August 2020

Xion
@0x10n
Dec 28, 2024
Congrats to everyone! Honored to take the first place :)
Google VRP (Google Bug Hunters)
@GoogleVRP
Dec 28, 2024
📯 Announcing the top 20 Chrome VRP researchers for 2024: crbug.com/386306231 📯 Congratulations to everyone on the list! Many thanks and much gratitude to our entire Chrome VRP researcher community and helping us make Chrome Browser & Chromium more secure for all users! 🎊
18K
Xion
@0x10n
Jan 18, 2025
The most elegant V8 Wasm Turboshaft typer exploit that I've reported. This primitive converts **any** Wasm type confusion in **any type hierarchy** into fully controlled arbitrary type confusion - e.g. what happens if you type `null : ref extern`? RCE :) crbug.com/372269618
20K
Xion
@0x10n
Oct 8, 2024
hackerone.com/reports/2260337 😉
Sonar Research
@Sonar_Research
Oct 8, 2024
From HTTP request to ROP chain in Node.js! 🔥 Our latest blog post explains how to turn a file write vulnerability in a Node.js application into RCE – even though the target's file system is read-only: sonarsource.com/blog/why-code-…
hackerone.com
Node.js disclosed on HackerOne: Permissions can be bypassed via...
**Summary:** Sending specific crafted messages to Node.js libuv signal event pipe allows an attacker to obtain arbitrary code execution primitives, bypassing any module-based permissions and...
19K
Xion
@0x10n
Oct 4, 2023
just a sloppy poc
Xion
@0x10n
Oct 4, 2023
🧐
GitHub - leesh3288/CVE-2023-4911: PoC for CVE-2023-4911
From github.com
29K
Xion
@0x10n
Nov 12, 2024
Uploaded my slides from POC2024. I'll soon be giving a slightly shorter version of the same talk on CODE BLUE 2024 too. github.com/leesh3288/talk…
Xion
@0x10n
Nov 5, 2024
I'm giving a talk on POC2024 (Nov. 7, Korea) and CODE BLUE 2024 (Nov. 14, Japan) on my VR adventures on Wasm engines in browsers (mostly Chrome). Unfortunately I can't talk about ~10 recent bugs, but there still will be several others and a whopping 10 v8sbx bypasses to share :)
23K
Xion
@0x10n
Mar 14, 2025
Sure, renderer exploits are fun, but have you tried adding hash collision constraints to it? crbug.com/381696874 crbug.com/382291459
20K
Xion
@0x10n
Aug 19, 2025
chromereleases.googleblog.com/2025/08/stable… [N/A][436181695] High CVE-2025-9132: Out of bounds write in V8. Reported by Google Big Sleep on 2025-08-04 TL;DR: Repro extremely short, bug very easily exploitable for a renderer RCE. Big Sleep is interesting indeed :)
chromereleases.googleblog.com
Stable Channel Update for Desktop
The Stable channel has been updated to 139.0.7258.138/.139 for Windows, Mac and 139.0.7258.138 for Linux which will roll out over the comi...
25K
Xion
@0x10n
Nov 5, 2024
I'm giving a talk on POC2024 (Nov. 7, Korea) and CODE BLUE 2024 (Nov. 14, Japan) on my VR adventures on Wasm engines in browsers (mostly Chrome). Unfortunately I can't talk about ~10 recent bugs, but there still will be several others and a whopping 10 v8sbx bypasses to share :)
34K
Xion
@0x10n
Jul 11, 2023
vm2 is now officially deprecated due to several vulnerabilities under disclosure process.
vm2 Is Actively Maintained Again - Project Status Update · Issue #533 · patriksimek/vm2
From github.com
45K
Xion
@0x10n
Oct 21, 2024
14K
Xion
@0x10n
Mar 22, 2024
Not bad for a first time I guess :)
TrendAI Zero Day Initiative
@thezdi
Mar 22, 2024
That's a wrap! #Pwn2Own Vancouver is complete. Overall, we awarded $1,132,500 for 29 unique 0-days. Congrats to @_manfp for winning Master of Pwn with $202,500 and 25 points. Here's the final top 10 list:
11K
Xion
@0x10n
Jul 2, 2024
PartitionAlloc still leaving us some super-easy-to-exploit raw pointers 🤗 This v8sbx bypass unfortunately still isn't fixed, work is underway to make the metadata read-only (i.e. ShadowMetadata)
xvonfers
@xvonfers
Jul 2, 2024
issues.chromium.org/action/issues/… @0x10n
13K
Xion
@0x10n
Nov 14, 2025
just imagine bypassing all wasm validation
Security Bug Aggregator
@BugsAggregator
Nov 6, 2025
Automated by @ret2happy
[433533359][reward: $70000] Consumers of ReadableStream subject to data race with SharedArrayBuffer, leading to RCE + V8 Sandbox bypass crbug.com/433533359
16K
Xion
@0x10n
Mar 20, 2024
yay :) now back to praying for tomorrow's Edge+Chrome double-tap entry 🙏
9.3K