Congrats to @mozilla for being the first vendor to patch their #Pwn2Own bugs. Oh - and go update #Firefox to get the fixes. That's two years in a row Mozilla has been the fastest. Well done!
[ZDI-25-292|CVE-2025-4919] Mozilla Firefox SpiderMonkey Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 8.8; Credit: Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) from Palo Alto Networks) zerodayinitiative.com/adviso…
Excellent! Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) from Palo Alto Networks used an Out-of-Bounds Write to exploit #Mozilla Firefox. They earn $50,000 and 5 Master of Pwn points. #Pwn2Own#P2OBerlin
First blood: Mozilla Firefox pwned at first attempt (in less than 2 seconds) using an out-of-bounds write vulnerability by Edouard Bochin (@le_douds) and Tao Yan (@Ga1ois) from Palo Alto Networks.
Really thrilled and truly honored to receive this year's Pwnie Award for Most Innovative Research with @le_douds. It's a wonderful wrap-up for our work. Can't wait to start the next journey of our research. Great thanks to @PwnieAwards! #defcon32
Confirmed! @le_douds and @Ga1ois from Palo Alto used an OOB Read plus a novel technique for defeating V8 hardening to get arbitrary code execution in the renderer. The were aboe to exploit #Chrome and #Edge with the same bugs, earning $42,500 and 9 Master of Pwn points. #Pwn2Own