Alex Laboirie · Security research
These write-ups document the findings, the tests, and how the investigations unfolded.
Two programs keeping Solana's shared record processed the same transactions but saved different data. An isolated test network showed why, and a one-line fix made them agree.
Disclosed by Google in the Chrome 154 security update, with credit to alex.laboirie. The technical write-up is not yet public.
A converted Photoshop picture could contain data left in the program's memory, turned into pixels that were never in the original image.
A signed-in user without administrator permission could make Jenkins contact a supplied server. The form returned an error, but the connection had already happened.
