Publications

Research, write-ups,
and disclosure notes.

Long-form pieces on the vulnerabilities we've found, the tooling we built to find them, and the techniques we used to exploit them.

2026

July 7, 2026 linux

IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011. Triggering the bug does not require any special kernel config or privilege. By turning it into a 97% stable privilege escalation and container escape, Google has rewarded us $92,337 in kernelCTF. This writeup covers the technical details of the exploit.

17 min read

June 29, 2026 chrome

Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307

Chrome V8 JavaScript engine features a heap sandbox to prevent an attacker from writing outside of the sandbox region with only a vulnerability in their JavaScript engine. However, VEGA discovered a special bug in the JIT compiler that allows an attacker to gain arbitrary read/write primitives in sandbox and even escape the sandbox to write outside of it solely on its own. This writeup will cover the technical details of the vulnerability.

19 min read

May 7, 2026 chrome

How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865

In March, our system detected a severe vulnerability in V8, the JavaScript engine used by Chrome. This vulnerability enabled remote code execution against billions of Chrome users worldwide.

15 min read

Research, write-ups, and disclosure notes.

IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

Longinus: 2 Boundaries in One Bug, Piercing Chrome’s Renderer and V8 Sandbox with a Single Vulnerability, CVE-2026-6307

How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865

Research, write-ups,
and disclosure notes.