Carl Smith (@cffsmith) header
Carl Smith (@cffsmith) profile picture

Security @Google; @FluxFingers/@Sauercl0ud; previously V8 Security, Intern {Project Zero, @XI_Research}. Personal account. https://teapawt.net/t.co/w9zosKSHdh on Bluesky.

Switzerland, Germany, USA
Joined May 2014
Carl Smith retweeted
[VXCON 2026] Celebrating 16 Years of Hacking: Deep-Dive into Exclusive Offensive Security & AI Tracks (Register Now!) Dear Cybersecurity Professional, The wait is over. VXCON is returning for its landmark 10th Anniversary edition this November 28–29, 2026, in Hong Kong. Since our journey began in 2010, VXCON has dedicated the last 16 years to building an elite community of white-hat hackers, malware analysts, reverse engineers, and offensive security researchers. To celebrate this milestone, we are bringing together global trail-blazers who frequently speak at Black Hat, DEF CON, and HITCON. They will break down live vulnerabilities, exploit pathways, and hardware weaknesses you won’t see anywhere else. Secure your seat today to learn from the best in the industry: vxcon.hk Featured Keynotes & Technical Briefings Our 2026 lineup features exclusive research spanning OS kernels, automated AI hacking agents, automotive systems, and critical infrastructure. 🛡️ Windows Kernel & Browser Exploitation • Angelboy (MSRC Top 100) covers cross-component vulnerabilities in the Windows Ancillary Function Driver (AFD), detailing transport-layer gadgets and sandbox escapes via Zoom. • MinJeong Kim explores variant hunting in WebKit by tracing patches to root causes and introduces the AI-driven WebKit Weekly framework. 🤖 The Frontier of AI & Automation in Security • Wonyoung Jung debuts a hybrid LLM and program analysis framework to automate patch diffing and N-day PoC generation. • Donghyeon Kim & Prof. Insu Yun (KAIST Hacking Lab) break down an autonomous agent that tackled CODEGATE 2026 challenges. 🚗 Automotive, Hardware, & Infrastructure (OT) Security • Dr. Camille Gay & Alina present exclusive car hacking and vehicle network research. • Edward Lee (OPCIA) demonstrates how to extract operational tags from proprietary OT traffic and detect unauthorized PLC modifications. • Iceman dives into signaling vulnerabilities, RFID exploitation, and new analysis hardware. Day 2: Hands-On Interactive Workshops • Bootrom Dumping: xenocidewiki (Secret Club) leads a hardware workshop on dumping encrypted pet firmware from a Tamagotchi Paradise via UART/SWD analysis. • Hardware & RFID: Led by Iceman. • Car Hacking: Led by Dr. Camille Gay & Alina. Event Logistics & Venues • Day 1 (Nov 28, 2026): Main Briefings at Marco Polo Hongkong Hotel (google.com/search?kgmid=%2Fg…) (Centenary Room II-III), including a network buffet lunch. • Day 2 (Nov 29, 2026): Workshops & Village (10:00 - 18:00) at JobsDB by SEEK (google.com/search?kgmid=%2Fg…), PCCW Tower, Quarry Bay. Registration Details Seating is limited. Secure your pass at vxcon.hk. For inquiries, contact [email protected]
1
7
1
10
987
Carl Smith retweeted
After a few years in beta, the V8 Sandbox is now considered a real security boundary! (Just announced at OffensiveCon Tokyo together with @mlippautz). This is less about reaching a particular software milestone than about two things:
5
24
1
195
12,141
And the last talk for this edition! 100 Exploits Later: V8 Security in the Age of AI by @5aelo and @mlippautz
3
1
21
1,597
LLMs are great at finding bugs, but so are fuzzers. @5aelo compared the vulnerabilities found in V8 by BigSleep, an agentic system, with those found by the Fuzzilli fuzzer. projectzero.google/2026/10/f…
13
109
7
445
42,717
100 V8 Exploits: lessons learned from three years of v8CTF by @_tsuro and Carl Smith
1
7
85
4,593
Agenda for OffensiveCon Tokyo 2026 is live! Explore the talks and plan your schedule now: offensivecon.jp/agenda/2026.… #OffensiveCon #Tokyo
22
6
39
9,760
Carl Smith retweeted
#Zer0Con2026 - SPEAKER 🎃 Pumpkin Chang(@u1f383) from DEVCORE - “Modern Android Kernel Exploitation Through a Mali Driver Vulnerability” For more: zer0con.org
15
117
5,270
Carl Smith retweeted
#Zer0Con2026 - SPEAKER 🌌 Brendon Tiszka from Google Project Zero - “Researcher’s Guide to the Galaxy: Digging into Samsung 0-click, Android Messengers, DNG, and other image formats” For more: zer0con.org
5
56
3,235
Carl Smith retweeted
We derestricted crbug.com/382005099 today which might just be my favorite bug of the last few years: bad interaction between WebAudio changing the CPU's handling of floats and V8 not expecting that. See crbug.com/382005099#comment1… for a PoC exploit. Also affected other browsers
4
48
4
246
22,824
Carl Smith retweeted
I'm pretty excited about this (POE2 in particular)! It's basically what we've been preparing for with the PKEY-based hardware sandboxing prototype for V8 (docs.google.com/document/d/1…)
More HW security goodness from Arm: community.arm.com/arm-commun… vMTE (Virtual Memory Tagging) allows to use MTE in a more flexible way, consuming less RAM. POE2 allows to build efficient in-process sandboxes and isolation. More-or-less improvement over x86 Memory Protection Keys.
8
1
61
13,706
Carl Smith retweeted
If you like Chrome IPC shenanigans like this, you might also enjoy my talk from black hat 25: youtu.be/qhhJCLy0YBA?si=qLz2…
Whoah... $250000 (CVE-2025-4609, similar to CVE-2025-2783/412578726)[412578726][Mojo][IpczDriver]ipcz bug -> renderer duplicate browser process handle -> escape sbx is now open with PoC & exploit(success rate is nearly 70%-80%) issues.chromium.org/issues/4… issues.chromium.org/issues/4…
3
35
227
38,032
Carl Smith retweeted
That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes) googleprojectzero.blogspot.c…
48
2
130
24,395
Carl Smith retweeted
We released our Fuzzilli-based V8 Sandbox fuzzer: github.com/googleprojectzero… It explores the heap to find interesting objects and corrupts them in a deterministic way using V8's memory corruption API. Happy fuzzing!
2
71
291
25,016
Carl Smith retweeted
If you have a machine with PKEY support and recent Linux kernel you can now play around with hardware support for the V8 sandbox. When active, JS + Wasm code has no write permissions outside the sandbox address space. To enable, set `v8_enable_sandbox_hardware_support = true`.
3
17
3
76
11,621
Carl Smith retweeted
My writeup of the 2023 NSO in-the-wild iOS zero-click BLASTDOOR webp exploit: Blasting Past Webp - googleprojectzero.blogspot.c…
22
234
11
700
88,733
Carl Smith retweeted
Senior Software Engineer, V8 Bug Detection: google.com/about/careers/app… Software Engineer II, V8 Bug Detection: google.com/about/careers/app…
6
21
3,922
Carl Smith retweeted
V8 Security is hiring in Warsaw! If you want to work on improving our JavaScript and Wasm fuzzers, check out the links below!
2
26
2
89
22,951
I tweeted before about the Apple CoreAudio issues found by Google TAG. Well, the fuzz harness used to find these issues is now included in Jackalope examples, see github.com/googleprojectzero… . Happy fuzzing! :)
The latest Apple security update contains fixes for three CoreAudio issues (CVE-2025-24160, CVE-2025-24161, CVE-2025-24163). These were found by Google Threat Analysis Group using Jackalope fuzzer.
2
39
1
180
30,426