-
-
Exploiting Chromium 140 Renderer Process
CVE-2025-10891 RCE PoC
By m411kPostscriptum: OtterSec have since exploited this same bug on mobile renderers more elegantly (no stack pivot: bytecode-smuggled constants reach DeserializeWasmModule with a shellcode-packed Wasm module), and that’s on ARM, where the 16-byte SP alignment requirement made stack pivoting painful for me. [Read More] -
Tiktok's Open Redirect
Watch your Regexes!
By m411k -
Reading your files is two ~~steps~~ flags away
Never _vibe_ code flags!
By m411k -
Browser Exploitation Primer
An Introduction
By m411kThis is the white paper of a talk I’ve delivered across several meetups: EliteSec & 42 Berlin / HackTheBox Ben Guerir Meetup (May 2025), IDEH CIT, INPT (January 2026, with improved material), and the DefCon Casablanca Meetup (June 2026), where I added analysis of CVE-2026-3910 and CVE-2025-10891. [Read More]