New blog post on the abuse of the IDispatch COM interface to get unexpected objects loaded into a process. Demoed by using this to get arbitrary code execution in a PPL process. googleprojectzero.blogspot.com/2025/01/wind...
Any sense of when the blog is going up? :)
Woot j00ru just dropped another FFI CVE: project-zero.issues.chromium.org/issues/42451...
I had the privilege of hanging out with j00ru at REcon Montreal after my talk about False File Immutability. I just found out that his latest work, CVE-2024-43452, was directly inspired by my talk and our chat. Feels good, man. project-zero.issues.chromium.org/issues/42451...
