Firefox JIT Bug - Pwn2Own Documentary (Part 3)

We talk to Manfred Paul and learn about his research process. We also dive into the technical details about his JIT bug and learn about the optimization he exploited. LEARN ON HEXTREE (ad) Learn hacking on Hextree: https://www.hextree.io/ Join the Hextree Discord: https://discord.gg/xgQpCQCpvy Part 1: https://www.youtube.com/watch?v=YQEq5s4SRxY Part 2: https://www.youtube.com/watch?v=uXW_1hepfT4 Part 3: https://www.youtube.com/watch?v=NT1VCmJF3mU Part 4: https://www.youtube.com/watch?v=x4CUAuwoZVk (Spoilers) Firefox Security Response to Pwn2Own 2025: https://blog.mozilla.org/security/2025/05/17/firefox-security-response-to-pwn2own-2025/ CHAPTERS 00:00 - Day one response timeline 01:36 - The $50,000 Firefox zero-day 02:59 - Manfred Paul's motivation and last-minute find 04:11 - Manual code review versus fuzzing 06:01 - JIT optimization and differential fuzzing 07:09 - Mathematical reasoning in security research 09:35 - Why bounds-check elimination matters 11:50 - Merging redundant array bounds checks 12:50 - Infinite versus modular arithmetic 14:05 - Triggering 32-bit wraparound with OR 0 15:13 - Proof of concept and out-of-bounds read 16:05 - Manfred's live Pwn2Own attempt 17:20 - Calculator pop and successful exploit 18:28 - Part four preview 18:41 - Why fundamentals still matter with AI SUPPORT Per video: https://www.patreon.com/join/liveoverflow Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): https://shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: https://www.youtube.com/LiveUnderflow Twitch: https://twitch.tv/LiveOverflow/ Twitter: https://twitter.com/LiveOverflow/ Instagram: https://instagram.com/LiveOverflow/ TikTok: https://www.tiktok.com/@liveoverflow_ LiveOverflow blog: https://liveoverflow.com/ Hextree blog (ad): https://www.hextree.io/blog #Pwn2Own #Firefox #LiveOverflow (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.