Reposted by Carl SmithAnthony @darkfloyd1216.bsky.social · 20/02/2025Congratulations to Carl Smith from v8 Security team and join Blackhat USA review board as guest reviewer. He is willing to share, open-minded, and a hardcore researcher and developer. @rwx.page 021
Carl Smith @rwx.page · 04/02/2025I’m very excited to announce that we at V8 Security have finally published our first version of Fuzzilli that understands Wasm! Go check it out at github.com/googleprojectzero/fuzzil…. While we still have a way to go in improving it, we think it shows a promising approach! 13116
Reposted by Carl SmithSamuel Groß @saelo.bsky.social · 13/11/2024Another big step towards becoming a security boundary: today we’re expanding the VRP for the V8 Sandbox * No longer limited to d8 * Rewards for controlled writes increased to $20k * Any memory corruption outside the sandbox is now in scope bughunters.google.com/about/rules/... Happy hacking!bughunters.google.comChrome Vulnerability Reward Program Rules | Google Bug HuntersATTENTION As of 4 February 2024, Chromium has migrated to a new issue tracker, please report security bugs to the new issue tracker using this form . Please see the Chrome VRP News and FAQ page for mo... 12810
Reposted by Carl SmithSamuel Groß @saelo.bsky.social · 22/05/2024Finally got around to publishing the slides of my talk @offensivecon.bsky.social from ~two weeks ago. Sorry for the delay! The V8 Heap Sandbox: saelo.github.io/presentation... Fantastic conference, as usual! :) 045
Reposted by Carl SmithSamuel Groß @saelo.bsky.social · 20/10/2023Here's another V8 sandbox design document, this time discussing how sensitive ("trusted") V8-internal objects (such as BytecodeArrays) can be protected: docs.google.com/document/d/1... This should be one of the last pieces of infrastructure required for the sandbox.docs.google.comV8 Sandbox - Trusted SpaceV8 Sandbox - Trusted Space Author: saelo@ First Published: October 2023 Last Updated: October 2023 Status: Living Doc Visibility: PUBLIC This document is part of the V8 Sandbox Project and discusses... 172
Reposted by Carl Smithdmnk @dmnk.bsky.social · 12/08/2023One day, @rwx.page and me got bored and built a tiny command line game with 0 deps in 🦀. `cargo install quarto` It's not much but it's honest work :) github.com/domenukk/quarto_rs 011
