How I found CVE-2026-20643
An origin confusion bug in WebKit's Navigation API. I ported FuzzOrigin to WebKit's test runner, added Navigation API grammar patterns, and found a CSRF bypass across subdomain boundaries...
Blog
Thoughts on browser security, privacy, and the open internet
JIT-Repicker: Differential Fuzzing Reborn
Reimplementing differential fuzzing for modern JavaScript engines. From understanding JIT compilation to building a production-ready fuzzer on top of Fuzzilli...
The internet is bad now.
Five websites, each filled with screenshots from the other four. A look at how the open web became a handful of walled gardens, and why the IndieWeb movement might be the most sensible response to it...
From "Not a Security Issue" to Supply Chain RCE
I reported an RCE in Android's gfxstream and Google told me it wasn't a security issue because it's inside a VM. So I escaped the Cuttlefish VM, landed on a self-hosted GitHub Actions runner, and turned it into a supply chain attack. Funny how threat models work...
coming soon
Studying Emergent Coordination in AI Security Teams
I'm building a simulation lab where a team of AI agents defends a fake company against a scripted intrusion campaign. The trick is that nothing in the prompts tells them how to coordinate — they just get alerts and a limited toolkit. If they figure out how to work together, that's the interesting part...
coming soon