Brian Grinstead
speaker
356 appearances
1 recordings
1 series
first heard Jun 2026
last heard 22 Jun
Brian Grinstead’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsRecordings per month over the last 12 months — 1 in all, peaking in Jun 2026 with 1.
Appearances
The thing that makes this different is that we have this.
And so this is like a really kind of complicated HTML page.
This is what browsers have to deal with, people making pages like this.
And they're like creating the element.
They're setting what's called an expando property on the DOM node, which is like an attribute, but not an attribute.
It removes the element.
It does some cycle collection, blah, blah, blah.
And at the end, it creates heap use after free, which is, this is exactly the sort of shape of a bug report that we send on to our engineering team.
That is exactly the thing.
And that is the thing that makes this approach different from previous attempts.
Yeah, I just, I could add one thing on that.
For your projects, I think that one difference is, so we've actually open sourced the sort of tooling that we use for Firefox, I think just yesterday for some of this.
So for security researchers who wanted to test it.
For our case, we have what we call a very crystal clear task verification signal.
And so we have this fuzzing build that uses an address sanitizer and it's like you win or you lose.
You pass the file and we can tell you AD.
Often if you have a web app, a distributed system of some kind, it may not be so crystal clear.
And so you need to think really hard for your project about your threat model.
And then how would you like to verify whether it's true or not?
Like could be like a test case or it could be, I think that's actually something that as you're thinking about applying this to your own project, that is a really important aspect of it.
Showing 161–180 of 356 · page 9 of 18
← Previous
Next →