Zero Day Engineering (@zerodayalpha) / X

Zero Day Engineering

395 posts

Zero Day Engineering

@zerodayalpha

State-of-the-art vulnerability research & exploit intelligence • @alisaesage @zerodaytraining

Worldwide

zerodayengineering.com

Joined January 2015

Zero Day Engineering
@zerodayalpha
Mar 23, 2024
Release: VM Escape Exploit for Parallels Desktop Hypervisor (Pwn2Own 2021) zerodayengineering.com/research/pwn2o… (source code + video walkthrough) A virtual machine escape exploit will typically require kernel privileges in the guest OS. In this exploit I chose to offload the
43K
Zero Day Engineering
@zerodayalpha
Nov 30, 2023
Research insights on recent Chrome 0day in Skia (CVE-2023-6435) from our lab: 1. The bug is an integer overflow in Skia, an open source library for rendering 2D graphics which which is used in Chromium backend. 2. The bug can be used to escape browser sandbox in Chrome app on
57K
Zero Day Engineering
@zerodayalpha
Jul 22, 2025
⚡️ 0-Day Alert - Google Chrome exploit in the wild CVE-2025-6558: EoP in GPU process / sandbox escape via WebGL ES2 backend Patched in Chrome Stable channel 138.0.7204.157/.158 for Windows and Mac and 138.0.7204.157 for Linux
26K
Zero Day Engineering
@zerodayalpha
May 13, 2021
New research blog: “From a Binary Patch to a Proof-of-concept: a VMware ESXi vmxnet3 Case Study”, by @alisaesage zerodayengineering.com/research/vmwar…
Zero Day Engineering
@zerodayalpha
Jun 4, 2025
⚡️ 0-Day Alert - Google Chrome exploit in the wild CVE-2025-5419: Memory corruption in v8 Patched in Chrome Stable Channel 137.0.7151.68/.69
23K
Zero Day Engineering
@zerodayalpha
Aug 26, 2025
🐞Bug Spotlight: Chrome Logic Sandbox Escape – $250,000 bounty (412578726) Cross-process handle spoofing issue in Ipcz, the new Mojo core driver. Exploit: renderer poses as the browser's broker-peer in reflected transport => leaks high-priv handles. Found by Micky @alisaesage
18K
Zero Day Engineering
@zerodayalpha
Dec 13, 2023
0-Day Insights - Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023 zerodayengineering.com/insights/qualc… (by @alisaesage)
36K
Zero Day Engineering
@zerodayalpha
Feb 23, 2022
New training: Zero Day Engineering zerodayengineering.com/training/ditto… The world’s only full stack training course on low-level aspects of computer security, offensive research and exploitation, created by a competitions-winning hacker with 20+ years of experience
Zero Day Engineering
@zerodayalpha
Jul 2, 2025
⚡️ 0-Day Alert - Google Chrome exploit in the wild CVE-2025-6554: TheHole leak Patched in Chrome Stable channel 138.0.7204.96/.97 for Windows, 138.0.7204.92/.93 for Mac and 138.0.7204.92 for Linux
11K
Zero Day Engineering
@zerodayalpha
Mar 29, 2024
This looks like a candidate for Chrome v8 0day bug used by @_manfp in his Pwn2Own 2024 exploit (CVE-2024-2887, just patched in Chrome stable 123.0.6312.86/.87) wasm module decoder had a missing check of type section size in a branch of DecodeTypeSection, easy to spot manually:
15K
Zero Day Engineering
@zerodayalpha
Jul 22, 2024
Remote kernel debugging the KVM hypervisor (full walkthrough video): youtu.be/cNfe4SguEYw KVM is distinguished from Qemu: the latter runs in user mode to handle device virtualization, while the former runs in privileged kernel to implement just the core hypervisor
15K
Zero Day Engineering
@zerodayalpha
Apr 30, 2024
Patch candidate for Chrome v8 Use-after-free to RCE bug (CVE-2024-3914) exploited by @0x10n at Pwn2Own 2024 Vancouver against both Chrome and Microsoft Edge. Patched in Chrome 124.0.6367.60/.61 This is not "quite" v8 - it's kinda blink reachable from v8. Classic array neutering
21K
Zero Day Engineering
@zerodayalpha
May 31, 2024
New video - technical conference talk: "JavaScript Engines Vulnerability Research: State of the Art" youtu.be/YpsfQl0V_3k (HITBxPHDAYS 2024 Bangkok, @alisaesage)
9.3K
Zero Day Engineering
@zerodayalpha
Nov 21, 2024
“4-step process I'm using to find my next 0-day (Learned from one of the best security researchers: Alisa Esage from Zero Day Engineering)” - William Chu, OSCE3, OSCP, CVEx1 @alisaesage @zerodaytraining
9.1K