The First Exploit - Pwn2Own Documentary (Part 2)

What happens in the Pwn2Own disclosure room? Let's find out in part 2 of my short documentary about how Mozilla fixes zero-days. LEARN ON HEXTREE (ad) Learn hacking on Hextree: https://www.hextree.io/ Join the Hextree Discord: https://discord.gg/xgQpCQCpvy Part 1: https://www.youtube.com/watch?v=YQEq5s4SRxY Part 2: https://www.youtube.com/watch?v=uXW_1hepfT4 Part 3: https://www.youtube.com/watch?v=NT1VCmJF3mU Part 4: https://www.youtube.com/watch?v=x4CUAuwoZVk (Spoilers) Firefox Security Response to Pwn2Own 2025: https://blog.mozilla.org/security/2025/05/17/firefox-security-response-to-pwn2own-2025/ CHAPTERS 00:00 - Heading into the disclosure room 01:54 - Waiting for ZDI to validate the submission 02:29 - Entering the room and sharing the exploit 02:46 - Promise.allSettled out-of-bounds write 04:20 - Reproducing and trying to bisect the bug 05:31 - Exploit stability and Firefox differences 07:20 - Leaving the disclosure room for Mozilla 08:21 - Coordinating the security incident 09:28 - ESR, Tor Browser, and six-year bisection 10:46 - Studying the exploit and improving fuzzing 11:49 - A prototype patch and variant search 12:24 - Why an open-source patch cannot land yet 13:14 - Risk assessment and overnight handoff 14:16 - Waiting for the second Firefox exploit SUPPORT Per video: https://www.patreon.com/join/liveoverflow Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join Buy my handwriting font (ad): https://shop.liveoverflow.com/ WATCH, FOLLOW & READ Second channel: https://www.youtube.com/LiveUnderflow Twitch: https://twitch.tv/LiveOverflow/ Twitter: https://twitter.com/LiveOverflow/ Instagram: https://instagram.com/LiveOverflow/ TikTok: https://www.tiktok.com/@liveoverflow_ LiveOverflow blog: https://liveoverflow.com/ Hextree blog (ad): https://www.hextree.io/blog #Pwn2Own #Firefox #LiveOverflow (ad) LiveOverflow YouTube channel is supported by advertisement and product placement.