 | Windows Exploitation Techniques: Dangling COM Object Registrations | 2026-09-21 | 75 | James Forshaw | True | | |
| A 0-click exploit chain for the Pixel 10: When a Door Closes, a Window Opens | 2026-05-13 | 75 | Seth Jenkins | True | | |
| A Deep Dive into the GetProcessHandleFromHwnd API | 2026-02-26 | 70 | James Forshaw | True | | |
| Bypassing Administrator Protection by Abusing UI Access | 2026-02-12 | 70 | James Forshaw | True | | |
| Bypassing Windows Administrator Protection | 2026-01-26 | 60 | James Forshaw | True | | |
| A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here? | 2026-01-14 | 75 | Natalie Silvanovich | True | | |
| A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave | 2026-01-14 | 75 | Seth Jenkins | True | | |
| A 0-click exploit chain for the Pixel 9 Part 1: Decoding Dolby | 2026-01-14 | 85 | Natalie Silvanovich | True | | |
| Thinking Outside The Box [dusted off draft from 2017] | 2025-12-16 | 75 | Jann Horn | True | | |
| Windows Exploitation Techniques: Winning Race Conditions with Path Lookups | 2025-12-16 | 65 | James Forshaw | True | | |
| Defeating KASLR by Doing Nothing at All | 2025-11-03 | 70 | Seth Jenkins | True | | |
| Pointer leaks through pointer-keyed data structures | 2025-09-26 | 25 | Jann Horn | True | | |
| From Chrome renderer code exec to kernel with MSG_OOB | 2025-08-08 | 80 | Jann Horn | True | | |
| The Windows Registry Adventure #8: Practical exploitation of hive memory corruption | 2025-05-28 | 75 | Mateusz Jurczyk | True | | |
| The Windows Registry Adventure #7: Attack surface analysis | 2025-05-23 | 70 | Mateusz Jurczyk | True | | |
