security · research log

Security research

Attack-surface notes and writeups. Newest first.

  1. CVE-2024-44308: Remote Code Execution via JavaScriptCore

    A missed register spill in WebKit's DFG compiler lets a malicious page run code inside the browser process on iOS.

    webkit · javascriptcore · rce · ios

  2. Mapping attack surfaces

    Every system has an attack surface. Mapping it before you poke anything saves the most time.

    reconnaissance · methodology · fundamentals