Chrome graphics input validation weakened an isolation boundary
One Chrome graphics report earned USD 250,000 across two award decisions.
USD 250,000reported awardRead
BRSecurity theme
Client and browser security.
Client-side isolation, memory safety, and security-sensitive state. 20 disclosures · 4 related references · 3 diagrams.
Connected collection
Disclosures
Codex metadata collection trusted repository execution helpers
ZDI awarded Doyensec USD 10,000 for this distinct Pwn2Own Berlin entry.
USD 10,000competition awardRead
Codex automated Git operations trusted repository hook settings
ZDI awarded Summoning Team USD 20,000 for this distinct Pwn2Own Berlin entry.
USD 20,000competition awardRead
Codex command approval relied on inconsistent parser semantics
ZDI awarded Compass Security USD 40,000 for this distinct Pwn2Own Berlin entry.
USD 40,000competition awardRead
V8 optimized object handling retained invalid type assumptions
One V8 type-consistency report earned a USD 50,000 award.
USD 50,000reported awardRead
V8 control-flow analysis omitted required initialization checks
A distinct V8 initialization-check report received a vendor-confirmed USD 50,000 award.
USD 50,000reported awardRead
Gemini-to-Colab rendering boundary exposed Workspace data
Google awarded USD 20,000 for the Colab-export finding in a multi-finding research article.
USD 20,000reported awardRead
Google IDX worker messaging crossed browser trust boundaries
A browser-IDE trust-boundary report received a USD 22,500 award.
USD 22,500reported awardRead
Bard Workspace integration weakened output-data boundaries
One Workspace data-disclosure finding within a broader research article earned USD 20,000.
USD 20,000reported awardRead
Meta Quest login migration lost OAuth credential confinement
Meta confirms a USD 44,250 total award, including bonuses, for this Quest OAuth account-access report.
USD 44,250reported awardRead
Pixel lock-screen completion lost security-state binding
A researcher-published vendor decision documents a USD 70,000 award for CVE-2022-20465.
USD 70,000reported awardRead
Instagram client configuration exposed an application credential
Meta confirmed a $30,000 base award for an Instagram application-token exposure; additional researcher-listed bonuses are excluded from the recorded amount.
USD 30,000reported awardRead
Meta Pixel cross-window handling lost message and token authority
The USD 32,500 researcher-reported award illustrates the distinction between message origin and disclosure authority.
USD 32,500reported awardRead
Meta Conversions API Gateway trusted message origins as script authority
The researcher assigns a separate $62,500 award to the client-side finding labeled Bug #1.
USD 62,500reported awardRead
Meta Conversions API Gateway mixed configuration data with executable output
The researcher attributes a USD 250,000 award to the article’s separately identified backend finding, Bug #2.
USD 250,000reported awardRead
Meta Accounts Center linking lost credential and identity confinement
A researcher-reported USD 30,000 award documents a cross-product account-linking trust failure.
USD 30,000reported awardRead
Facebook SDK message authentication relied on insecure randomness
A USD 66,000 researcher-reported award illustrates how weak message authentication and unsafe rendering can invalidate an SDK trust boundary.
USD 66,000reported awardRead
macOS SMBFS error handling left inconsistent kernel parser state
A rejected network response left inconsistent filesystem state. The researcher reports a $20,000 award and subsequent payment.
USD 20,000reported awardRead
Safari origin confusion undermined stored media permissions
The cited researcher documents a USD 75,000 award for this reported chain.
USD 75,000reported awardRead
iCloud sharing consent and Safari trust boundaries failed together
The cited researcher documents a USD 100,500 award for this reported chain.
USD 100,500reported awardRead
Connected collection
Related learning
Chromium Rule of Two: input trust, memory safety and privilege
An architecture policy for avoiding the combination of untrusted input, memory-unsafe implementation and high privilege. It explains safer parsing, privilege separation and careful review of unsafe code behind safe…
Reviewed 2026-10-02Read
Authorization Cheat Sheet
Practical design guidance covering least privilege, deny-by-default behavior, consistent per-request decisions, failure handling, logging, and authorization regression tests.
Reviewed 2026-10-02Read
HTML5 Security Cheat Sheet: Web Messaging
OWASP explains origin checks, expected message formats and treating exchanged content as data. These controls address different assumptions at browser communication boundaries.
Reviewed 2026-10-02Read
LLM Prompt Injection Prevention Cheat Sheet
Defense-in-depth guidance for LLM applications that consume untrusted content or invoke tools. Covers data provenance, least privilege, action authorization, monitoring, and the limitations of guardrails.
Reviewed 2026-10-02Read
Connected collection
Visual models
Retrieved content is data, not authority
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Browser messages need separate trust checks
Original defensive model combining OWASP messaging and authorization guidance with the linked historical cases. These are independent design checks, not a vendor patch diagram or an operational reproduction.
Reviewed 2026-10-02Read
Parsing safety and action authority
Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.
Reviewed 2026-10-02Read
Related learning follows the topic crosswalk or an explicit diagram relationship. It does not classify a resource as a finding. Topics overlap, so their counts should not be added together.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software