Vulnerability research
Patch changes, failed security decisions, safe reproduction, and explicit evidence limits for named vulnerabilities.
Start here, then go deeper.
Learn the method, then compare public CVEs through patch evidence, alternate producers, and failed assumptions.
- 01MethodThe Patch Is a Disclosure. The Bug Is in the Delta.8 min ↗
Patch diffing turns the vendor's fix into a map to the vulnerability. The workflow is not 'find the bug' — it is 'find the change, read it backwards, and hunt the same class everywhere else.'
- 02Part 1CVE-2025-24201: How Web Content Reached an Unneeded GPU State9 min ↗
A reader-first reconstruction of Apple's CVE-2025-24201 WebKit fix: what the sandbox-escape advisory says, what primitive restart means, and what the public patch proves without inventing the private exploit chain.
- 03CVE researchCVE-2025-32463: How a User-Controlled Chroot Loaded Code as Root11 min ↗
A reader-first root-cause analysis of CVE-2025-32463: how sudo entered an attacker-controlled filesystem before authorization completed, why NSS could then load a library as root, and what 1.9.17p1 changed.
- 04Variant boundaryCVE-2024-0044: How Installer Metadata Forged an Android App Identity13 min ↗
A reader-first variant analysis of Android CVE-2024-0044: how a crafted installer name could corrupt packages.list, mislead run-as, and why the first fix needed a follow-up.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 5
The Page Never Had Permission. The Extension Did.
A web page cannot call most extension APIs, but it can influence a content script that can message a privileged service worker. This research method proves when that chain becomes a confused deputy and how to reduce it to explicit, testable capabilities.
21 min read ↗Vulnerability Research · Aug 31, 2026The Package Was Signed. The Update Was Still a Security Decision.
A browser extension update preserves publisher identity while it can change code, permissions, remote configuration, and privileged behavior across an entire installed fleet. This research method turns that release path into an evidence-backed authorization boundary.
12 min read ↗Vulnerability Research · Aug 31, 2026The Extension Was Sandboxed. The Native Host Was Not.
Browser Native Messaging crosses from an untrusted page through an extension into an operating-system process. This research method maps every sender, message, host manifest, parser, native operation, and resulting effect before calling the bridge secure.
18 min read ↗Vulnerability Research · Aug 31, 2026Three False Alarms in a Privileged Helper Sweep
Seven third-party helpers run as root on this Mac. I checked whether each one authenticates the process talking to it, was wrong three times in a row, and found nothing. The interesting part is why each cheap method failed.
9 min read ↗Vulnerability Research · May 28, 2026The Patch Is a Disclosure. The Bug Is in the Delta.
Patch diffing turns the vendor's fix into a map to the vulnerability. The workflow is not 'find the bug' — it is 'find the change, read it backwards, and hunt the same class everywhere else.'
8 min read ↗CVE research 8
Calibrating a Root-Namespace Load Detector
I ended a CVE-2025-32463 write-up with a recommendation and never carried it out. This is what happened when I built the instrument to do it: an inert marker running as root, two detection layers that had to be redesigned mid-flight, and three ways the measurement lies to you.
9 min read ↗CVE-2024-0044 · Static ReproductionCVE-2024-0044: How Installer Metadata Forged an Android App Identity
A reader-first variant analysis of Android CVE-2024-0044: how a crafted installer name could corrupt packages.list, mislead run-as, and why the first fix needed a follow-up.
13 min read ↗CVE-2025-31205 · Static ReproductionCVE-2025-31205: How a Detached Stylesheet Exposed Cross-Origin Data
A reader-first analysis of CVE-2025-31205: how JavaScript kept a cross-origin stylesheet alive after detachment, why WebKit treated missing ownership as permission, and how the fix fails closed.
10 min read ↗CVE-2025-32463 · Static ReproductionCVE-2025-32463: How a User-Controlled Chroot Loaded Code as Root
A reader-first root-cause analysis of CVE-2025-32463: how sudo entered an attacker-controlled filesystem before authorization completed, why NSS could then load a library as root, and what 1.9.17p1 changed.
11 min read ↗CVE-2025-24201 · Static ReproductionCVE-2025-24201: How Web Content Reached an Unneeded GPU State
A reader-first reconstruction of Apple's CVE-2025-24201 WebKit fix: what the sandbox-escape advisory says, what primitive restart means, and what the public patch proves without inventing the private exploit chain.
9 min read ↗CVE-2024-4577 · CVE-2024-8926 · Static ReproductionCVE-2024-4577: How Windows Reopened PHP-CGI Command Injection
A reader-first variant analysis of CVE-2024-4577 and CVE-2024-8926: how Windows character conversion turned safe-looking query input into PHP-CGI options and why the first fix needed a follow-up.
10 min read ↗CVE-2024-6387 · Static ReproductionCVE-2024-6387: How an OpenSSH Timeout Could Lead to Remote Root Access
A clear reconstruction of regreSSHion: how an unauthenticated connection triggered unsafe signal-time logging in sshd, why that could corrupt the heap, which systems were exposed, and how OpenSSH 9.8p1 fixed the root cause.
11 min read ↗CVE-2024-3094 · Static ReproductionCVE-2024-3094: How a Backdoored XZ Release Reached OpenSSH
A clear reconstruction of the XZ Utils supply-chain attack: what was changed, how malicious release tarballs altered liblzma, why selected OpenSSH servers became reachable, and which systems were actually exposed.
11 min read ↗