79 vulnerabilities reported
CVEs
Vulnerabilities found and reported by our lab members.
| CVE-2026-46242 | Linux Kernel / Android | Bad Epoll: race-condition use-after-free in the Linux kernel's epoll subsystem | Jaeyoung Chung, Eulgyu Kim | Google kernelCTF $92,337 |
| CVE-2026-74637 1-day | Linux Kernel | Use-after-free in Linux kernel's perf/core subsystem | Jaeyoung Chung | Google kernelCTF $81,337 |
| CVE-2026-24190 | NVIDIA GPU | GPU driver exposes aperture flag modification API to user | Sihyun Roh | |
| CVE-2026-28243 | AMD GPU | Details undisclosed | Sihyun Roh | |
| CVE-2026-43557 | AMD GPU | Details undisclosed | Sihyun Roh | |
| CVE-2026-28240 | AMD GPU | Details undisclosed | Sihyun Roh | |
| CVE-2026-40649 | AMD GPU | Details undisclosed | Sihyun Roh | |
| CVE-2026-40680 | AMD GPU | Details undisclosed | Sihyun Roh | |
| CVE-2026-46213 | Linux Kernel | use-after-free in the Linux Kernel's apple keyboard driver | Sangyun Kim | |
| CVE-2026-46202 | Linux Kernel | atomic bug in the Linux Kernel's apple keyboard driver | Sangyun Kim | |
| CVE-2026-64500 | Linux Kernel | Uninitialized completion used by the IRQ handler in Linux kernel's LPC32xx ADC driver (iio), leading to kernel panic | Sangyun Kim, Kyungwook Boo, Jaeyoung Chung | |
| CVE-2026-64602 | Linux Kernel | Uninitialized completion used by the IRQ handler in Linux kernel's SPEAr ADC driver (iio), leading to kernel panic | Sangyun Kim, Kyungwook Boo, Jaeyoung Chung | |
| vLLM PR #49964 | vLLM | DCP KV cache block-size mismatch enables denial of service from a remote client | Jonguk Cheong | |
| Chromium Issue 508092629 | V8 Sandbox | V8 Sandbox Escape: Stale MicrotaskQueue cache leads to OOS write | Jihyeon Jeong | Google ChromeVRP $20,000 |
| Chromium Issue 506570358 | V8 Sandbox | V8 Sandbox Escape: CppHeapPointerTable evacuation entry causes OOS CppGC mark-bit write | Jihyeon Jeong | Google ChromeVRP $5,000 |
| CVE-2026-102658 | HotCRP | Exposure of confidential information through search timing channels | Taehyun Kang | |
| Chromium Issue 515252150 | V8 Sandbox | V8 Sandbox Bypass: EPT copied-handle laundering leads to MicrotaskQueue UAF | Jihyeon Jeong | Google ChromeVRP $2,500 + v8CTF 1-day $10,000 |
| Chromium Issue 532323117 | V8 Sandbox | V8 Sandbox Bypass: API callback provenance split causes Blink Window type confusion | Jihyeon Jeong | Google ChromeVRP $2,500 + v8CTF 1-day $10,000 |
| Chromium Issue 533506550 | V8 Sandbox | V8 Sandbox Bypass: forged ObjectBackedNativeHandler callback data triggers native UAF | Jihyeon Jeong | Google ChromeVRP $2,500 |
| Chromium Issue 534092070 | V8 Sandbox | V8 Sandbox Bypass: Parallel EPT evacuation can create a dangling Managed<BackingStore> and leads to OOS Write | Jihyeon Jeong | Google ChromeVRP $1,000 |
| Chromium Issue 537948358 | V8 Sandbox | V8 Sandbox Bypass: CompileLazy can install WasmResume into a mismatched JDT entry and control the native PC | Jihyeon Jeong | Google ChromeVRP $2,500 |
| CVE-2026-78899 | Chromium | BFCache Freeze interrupt API re-entry causes wrong Turboshaft Load Invalidation | Jihyeon Jeong | Google Chrome VRP $1,000 + v8CTF 0-day $10,000 |
| CVE-2026-91709 | Chromium | Stale Service Worker CacheStorage code cache leads to Renderer Exploit | Jihyeon Jeong | Google Chrome VRP $1,000 + v8CTF 0-day $20,000 |
| CVE-2026-6358 | Chromium | Details undisclosed | Jihyeon Jeong | |
| Chromium Issue 506689382 | Chromium | Process-global ICStats singleton race causes heap corruption via ic_stats tracing + Workers | Jihyeon Jeong | Google Chrome VRP $4,000 |
| CVE-2026-19556 | Chromium | TwoStringsToSlices drops an ExternalString owner before flattening the second string and causes a UAF | Jihyeon Jeong | Google Chrome VRP $500 |
| CVE-2026-15133 | Chromium | AuctionWorklet reportWin timeout triggers use-after-scope in deprecated renderUrl lazy getter | Jihyeon Jeong | Google Chrome VRP $500 |
| CVE-2026-84326 | Chromium | Turboshaft SSE keeps stale loop-visit decisions and publishes an uninitialized tagged field | Jihyeon Jeong | Google Chrome VRP $1,000 + v8CTF 0-day $10,000 |
| CVE-2026-87587 | Chromium | Maglev eager-inlined for...in state suppresses a receiver map check and causes UAF | Jihyeon Jeong | Google Chrome VRP $1,000 + v8CTF 0-day $10,000 |
| CVE-2026-89595 | Linux Kernel | fsnotify: Fix stale object mask after concurrent mark updates | Youngjae Kwon | |
| CVE-2026-47563 | NVIDIA GPU | Null dereference in NVIDIA GPU Display Driver | Junghyun Park | |
| CVE-2026-47559 | NVIDIA GPU | Cross process read/write in NVIDIA GPU Display Driver | Junghyun Park | |
| CVE-2026-47591 | NVIDIA GPU | read-only memory byapss in NVIDIA GPU Display Driver which enables local privilege escalation | Junghyun Park | |
| Chromium Issue 534213827 | V8 Sandbox | aliased Gin callback data outlives weak CallbackHolder ownership and causes OOS UAF | Jihyeon Jeong | Google ChromeVRP $2,500 |
| Chromium Issue 534317475 | V8 Sandbox | aliased Blink ScriptState EPT entry outlives Oilpan ownership and causes UAF | Jihyeon Jeong | Google ChromeVRP $2,500 |
| Chromium Issue 534522877 | V8 Sandbox | Details undisclosed | Jihyeon Jeong | |
| Chromium Issue 536503198 | V8 Sandbox | swapped Gin PerContextData handles cause a native teardown UAF | Jihyeon Jeong | Google ChromeVRP $2,500 |
| Chromium Issue 540430406 | V8 Sandbox | WasmCodeManager::LookupCode races NativeModule teardown and reads freed owned_code_ nodes | Jihyeon Jeong | Google ChromeVRP $1,000 |
| CVE-2026-91728 | Chromium | FeedbackVector signed size overflow under-allocates a 28-byte object and starts a 2^30-entry out-of-bounds initialization | Jihyeon Jeong | Google ChromeVRP $1,000 + v8CTF 0-day $10,000 |
| Chromium Issue 562249006 | V8 Sandbox | Details undisclosed | Jihyeon Jeong | |
| CVE-2026-87657 | V8 Sandbox | same-tag Managed<WasmStreaming> substitution races mutable StreamingDecoder::url_ after callback publication | Jihyeon Jeong | Google ChromeVRP $1,000 |
| CVE-2026-87491 | V8 Sandbox | WasmGetOwnProperty's no-write/no-throw effects allow a forged accessor to create mixed call_indirect dispatch and a native tiering-budget OOB write | Jihyeon Jeong | Google ChromeVRP $2,500 |
| Chromium Issue 546402114 | V8 Sandbox | cross-isolate RecordWrite races Scavenge and writes a Bucket* into a freed native SlotSet | Jihyeon Jeong | Google ChromeVRP $1,000 |
| Chromium Issue 546933181 | V8 Sandbox | concurrent WasmOrphanedGlobalHandle insertion and removal causes a native heap UAF write | Jihyeon Jeong | Google ChromeVRP $1,000 |
| Chromium Issue 547316681 | V8 Sandbox | background code-cache deserialization publishes a BytecodeArray before verification and causes a native-stack write | Jihyeon Jeong | Google ChromeVRP $1,000 |
| CVE-2026-23169 | Linux Kernel | Race condition in Linux kernel's MPTCP path manager (mptcp_pm_nl_flush_addrs_doit) due to a non-RCU-safe list splice, causing crashes | Eulgyu Kim | |
| CVE-2026-46157 | Linux Kernel | Data race on the runtime.oss.trigger bitfield in Linux kernel's ALSA PCM OSS emulation | Jaeyoung Chung | |
| CVE-2026-52910 | Linux Kernel | Use-after-free in Linux kernel's BPF socket filter: reuseport cBPF program freed without waiting for an RCU grace period | Eulgyu Kim | |
| CVE-2026-68387 | Linux Kernel | Data race on the raw_sock flags bitfield in Linux kernel's CAN raw socket (raw_setsockopt) | Eulgyu Kim | |
| CVE-2026-72133 | Linux Kernel | Uninitialized completion used by the IRQ handler in Linux kernel's UniPhier SPI driver | Sangyun Kim, Kyungwook Boo | |
| CVE-2026-90020 | Linux Kernel | NULL pointer dereference in Linux kernel's USB gadgetfs gadget_dev_ioctl() due to a race with bind | Jaeyoung Chung, Eulgyu Kim | |
| CVE-2026-90057 | Linux Kernel | Use-after-free in Linux kernel's SLIP driver (slip_receive_buf) racing with tty hangup | Jaeyoung Chung, Eulgyu Kim | |
| CVE-2026-97998 | Linux Kernel | Race between instance destruction and UNBIND in Linux kernel's netfilter nfnetlink_log, leading to a general protection fault | Jaeyoung Chung, Eulgyu Kim | |
| CVE-2025-37860 | Linux Kernel | NULL pointer dereference in Linux kernel's sfc (EF100) driver ef100_process_design_param() | Kyungwook Boo | |
| CVE-2025-38200 | Linux Kernel | Integer underflow leading to an MMIO write to an invalid page in Linux kernel's Intel i40e driver (i40e_clear_hw) | Kyungwook Boo | |
| CVE-2025-0819 | Arm GPU | Use-after-free in Arm Mali GPU kernel driver (Bifrost/Valhall/5th Gen) allowing access to already freed GPU memory | Jaeyoung Chung, Juhee Kim | |
| CVE-2026-79030 | Chromium | Observable discrepancy in Chrome Autofill allowing a remote attacker to obtain sensitive information via a crafted HTML page | Young Min Kim | Google Chrome VRP $2,000 |
| CVE-2026-4459 | Chromium | Out-of-bounds read and write in Chrome WebAudio | Jihyeon Jeong | |
| CVE-2026-47492 | NVIDIA GPU | Improper access control (missing authorization) in NVIDIA GPU Display Driver kernel mode layer, leading to denial of service | Sihyun Roh | |
| CVE-2026-47603 | NVIDIA GPU | Missing authorization in NVIDIA GPU Display Driver kernel mode driver lets a local user access another process's GPU channel state | Sihyun Roh | |
| CVE-2026-47609 | NVIDIA GPU | NVIDIA GPU Display Driver vulnerability (credited in NVIDIA acknowledgements; details not yet published) | Sihyun Roh | |
| CVE-2026-84567 | Apple macOS | Memory handling issue in macOS cd9660 file system allowing an app to cause unexpected system termination | Sihyun Roh | |
| CVE-2022-2481 | Chromium | Use-after-free in Chrome Views | YoungJoo Lee | |
| CVE-2023-1814 | Chromium | Insufficient validation of untrusted input in Chrome Safe Browsing | Young Min Kim | Google Chrome VRP $3,000 |
| CVE-2022-3661 | Chromium | Insufficient data validation in Chrome Extensions | Young Min Kim | Google Chrome VRP $3,000 |
| CVE-2022-0109 | Chromium | Inappropriate implementation in Chrome Autofill | Young Min Kim | Google Chrome VRP $4,000 |
| CVE-2021-43536 | Mozilla Firefox | URL leakage when navigating while executing an asynchronous function in Firefox | Sunwoo Kim, Young Min Kim | |
| CVE-2022-26382 | Mozilla Firefox | Firefox Autofill tooltip text could be inferred via font-based side channels | Young Min Kim | |
| CVE-2022-45420 | Mozilla Firefox | Iframe contents could be rendered outside the iframe in Firefox | Suhwan Song | |
| CVE-2024-0748 | Mozilla Firefox | Compromised content process could update the document URI (address bar / history spoofing) in Firefox | Young Min Kim | |
| CVE-2022-32784 | Apple Safari | UI handling issue in Safari Extensions that may leak sensitive data when visiting a malicious website | Young Min Kim | |
| CVE-2022-23261 | Microsoft Edge | Microsoft Edge (Chromium-based) tampering vulnerability | Young Min Kim | |
| CVE-2022-24071 | NAVER Whale | Built-in extension in Whale browser lets a compromised renderer control browser internal APIs | Young Min Kim | |
| CVE-2022-24072 | NAVER Whale | Whale devtools API (devtools.inspectedWindow) lets extensions inject JavaScript into the extension store page | Young Min Kim | |
| CVE-2022-24073 | NAVER Whale | Whale Web Request API lets extensions block or redirect access to the extension store | Young Min Kim | |
| CVE-2022-24074 | NAVER Whale | Whale Bridge default extension accepts SendMessage requests from content scripts, enabling control after renderer compromise | Young Min Kim | |
| CVE-2022-24075 | NAVER Whale | Whale extensions can replace HWP viewer scripts to read local HWP files | Young Min Kim | |
| CVE-2021-20257 | QEMU | Infinite loop in QEMU e1000 NIC emulation (process_tx_desc) allowing a guest to cause host denial of service | Cheolwoo Myung | |
| CVE-2020-25723 | QEMU | Reachable assertion in QEMU USB EHCI emulation allowing a guest to crash the QEMU process (denial of service) | Cheolwoo Myung |