Blog
Welcome to Tashita’s vulnerability research blog. Here our team publishes in-depth technical analysis of real-world vulnerabilities: browser exploitation, JavaScript engine internals (V8, WebKit, JavaScriptCore), fuzzing techniques, and full exploit walkthroughs from our CVE discoveries. Every post comes from the same research workflow that powers SeekZero, our browser vulnerability research framework.
Where Pixels Go Wrong: Chrome’s Graphics Stack
Graphics bugs show up at every layer of Chrome's graphics stack, and attackers use them more than they used to. The standout is uninitialized memory: 91 fixes in 2026, against 6 in the nine years before.
Vulnerability Survey
V8 Bugs in the Agentic Era
Far more bugs are being found, in more places and of more kinds. The bugs that attackers actually use still look the way they always have.
Mutation Timeline
Following Each Change to a JavaScript Sample
Introduction A JavaScript fuzzer rarely builds a complex sample in one step. It may change an operator, insert a statement, replace a loop body, and then make further changes to the code it introduced. By the time we inspect[...]
How ASTs Change the Way You Think About JavaScript
For vulnerability research and programmable fuzzing
Is This Valid JavaScript? Let's analyze this JavaScript program: It looks like strange and unusual code, which raises some interesting questions: Is it valid JavaScript code? How many structures are there here? What possibilities and restrictions do[...]
Code Targeting
Keeping Fuzzing Focused on Specific V8 Code
Introduction Coverage-guided fuzzing is designed to find new execution paths. In targeted vulnerability research, however, we may already know which part of the JavaScript engine we want to explore. A previous vulnerability, a suspicious commit, or a source-code[...]
Fuzzing Complex JavaScript Structures
Building complex programs without losing the research goal
Finding the Unexpected The basic idea behind a JavaScript engine fuzzer is very simple: generate programs that the engine does not expect to execute. The difficult part is defining what unexpected actually means. V8, JavaScriptCore, and SpiderMonkey[...]