Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Man Mo
How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework
GitHub Security Lab Taskflow Agent is very effective at finding Auth Bypasses, IDORs, Token Leaks, and other high-impact vulnerabilities. & March 6, 2026 | 20 minutes Share: For the last few months, we’ve been using the GitHub Security Lab Taskflow Agent along with a new set of auditing taskflows that specialize in finding web security vulnerabilities. They also turn out to be very successful at finding high-impact vulnerabilities in open source projects.
AI-supported vulnerability triage with the GitHub Security Lab Taskflow Agent
Learn how we are using the newly released GitHub Security Lab Taskflow Agent to triage categories of vulnerabilities in GitHub Actions and JavaScript projects. & January 20, 2026 | 22 minutes Share: Triaging security alerts is often very repetitive because false positives are caused by patterns that are obvious to a human auditor but difficult to encode as a formal code pattern.
Bypassing MTE with CVE-2025-0072
Home / Security / Vulnerability research In this post, I’ll look at CVE-2025-0072, a vulnerability in the Arm Mali GPU, and show how it can be exploited to gain kernel code execution even when Memory Tagging Extension (MTE) is enabled. May 23, 2025 | 10 minutes Share: Related posts This May marks the fifth annual Maintainer Month, and there are lots of treats in store: new badges, special discounts, events with experts, and more.
The second half of software supply chain security on GitHub
Home / Security / Supply chain security Learn about a community-developed framework for how to think about this problem holistically and how to use GitHub, particularly, to improve the security in the second half of your software supply chain. ·@steiza October 8, 2024 | 6 minutes Share: Software supply chain security has rocketed into the public consciousness after a major cybersecurity attack against the U.S. federal government was made public in late 2020.
Cybersecurity spotlight on bug bounty researcher @imrerad
Home / Security / Vulnerability research For this year’s Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to feature another spotlight on a talented security researcher who participates in the GitHub Security Bug Bounty Program—@imrerad! October 1, 2024 | Updated October 2, 2024 | 5 minutes Share: Related posts Learn about a community-developed framework for how to think about this problem holistically and how to use GitHub, particularly, to improve the security in the...
Kicking off Cybersecurity Awareness Month: Researcher spotlights and additional incentives!
Home / Security / Vulnerability research For this year’s Cybersecurity Awareness Month, GitHub’s Bug Bounty team is excited to offer some additional incentives to security researchers! September 26, 2024 | 2 minutes Share: Related posts In this post, I’ll exploit CVE-2024-5830, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.
From object transition to RCE in the Chrome renderer
Home / Security / Vulnerability research In this post, I’ll exploit CVE-2024-5830, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site. August 13, 2024 | 13 minutes Share: Related posts Introducing the generally available capability of GitHub Artifact Attestations to secure your cloud-native supply chain packages and images.
Configure GitHub Artifact Attestations for secure cloud-native delivery
Home / Security / Supply chain security Introducing the generally available capability of GitHub Artifact Attestations to secure your cloud-native supply chain packages and images. July 30, 2024 | 6 minutes Share: When deploying in a truly cloud-native way, we need to ensure that we can trust what we’re deploying at every step of our supply chain. We need to be certain that what we think we are deploying is what we are actually deploying.
3 ways to get Remote Code Execution in Kafka UI
Kafka UI is a popular open source web application designed to manage and monitor Apache Kafka clusters. It is used mainly by developers and administrators to provide visual representation of the connected Kafka clusters. Some users may not be aware that in its default configuration, Kafka UI does not require authentication to read and write data. This results in many unprotected Kafka UI instances deployed in internal networks or even being exposed to the internet.
Attack of the clones: Getting RCE in Chrome’s renderer with duplicate object properties
In this post, I'll exploit CVE-2024-3833, an object corruption bug in v8, the Javascript engine of Chrome, that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site. Explore more from GitHub Secure platform, secure data. Everything you need to make security your #1. Get tickets to the 10th anniversary of our global developer event on AI, DevEx, and security. Don't fly solo. Try 30 days for free. Check out our current job openings.
Execute commands by sending JSON? Learn how unsafe deserialization vulnerabilities work in Ruby projects
Can an attacker execute arbitrary commands on a remote server just by sending JSON? Yes, if the running code contains unsafe deserialization vulnerabilities. But how is that possible? In this blog post, we’ll describe how unsafe deserialization vulnerabilities work and how you can detect them in Ruby projects. All samples in this blog post are made using the Oj JSON serialization library for Ruby, but that does not mean they are limited to this library.
Security research without ever leaving GitHub: From code scanning to CVE via Codespaces and private vulnerability reporting
Hello fellow readers! Have you ever wondered how the GitHub Security Lab performs security research? In this post, you’ll learn how we leverage GitHub products and features such as code scanning, CodeQL, Codespaces, and private vulnerability reporting. By the time we conclude, you’ll have mastered the art of swiftly configuring a clean, temporary environment for the discovery, verification, and disclosure of vulnerabilities in open source software (OSS).
Gaining kernel code execution on an MTE-enabled Pixel 8
In this post, I’ll look at CVE-2023-6241, a vulnerability in the Arm Mali GPU that allows a malicious app to gain arbitrary kernel code execution and root on an Android phone. I’ll show how this vulnerability can be exploited even when Memory Tagging Extension (MTE), a powerful mitigation, is enabled on the device. Explore more from GitHub Secure platform, secure data. Everything you need to make security your #1. Stories and voices from the developer community. Don't fly solo. Try 30 days for free.
Securing our home labs: Home Assistant code review
Introduction In July, the GitHub Security Lab team conducted a collaborative review of one of our favorite software pieces. While it’s not uncommon for our Security Lab researchers to work together on audits and research projects, we found that conducting team audits occasionally provides a valuable opportunity for team members to learn from each other and expand the scope of the review beyond what could be accomplished individually or in pairs.
Getting RCE in Chrome with incomplete object initialization in the Maglev compiler
In this post I’ll exploit CVE-2023-4069, a type confusion vulnerability that I reported in July 2023. The vulnerability—which allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site—is found in v8, the Javascript engine of Chrome. It was filed as bug 1465326 and subsequently fixed in version 115.0.5790.170/.171.
Getting RCE in Chrome with incorrect side effect in the JIT compiler
In this post, I’ll explain how to exploit CVE-2023-3420, a type confusion vulnerability in v8 (the Javascript engine of Chrome), that I reported in June 2023 as bug 1452137. The bug was fixed in version 114.0.5735.198/199. It allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site. Vulnerabilities like this are often the starting point for a “one-click” exploit, which compromise the victim’s device when they visit a malicious website.
Introduction to SELinux
At GitHub Security Lab, our main mission is helping secure the open source software we all rely on. While securing applications themselves is important, one of the best ways developers and system administrators can ensure the security of their systems is to create multiple layers of privilege.
Chrome Renderer Type Confusion / Remote Code Execution
Proof of concept remote code execution exploit that demonstrates a vulnerability in the Chrome renderer sandbox by simply visiting a malicious website.
Chrome V8 Logic Bug / Use-After-Free
Chrome V8 Logic Bug / Use-After-Free Authored by Man Yue Mo, GitHub Security Lab Proof of concept for a logic bug in the implementation of the garbage collector (GC) in v8 (the JavaScript interpreter of Chrome). The exploit poc.js is tested on v8 version 9.4.146.16 (commit 452f57b), which is the version shipped with Chrome 94.0.4606.61, the one before the bug was fixed, on Ubuntu 20.04.
Chrome WebAudio Use-After-Free
Proof of concept exploit for a Chrome use-after-free vulnerability of non-garbage-collected objects, which is allocated by the PartitionAlloc memory allocator.
Chrome JIT Compiler Type Confusion
Proof of concept exploit for a type confusion bug in the JIT compiler of Chrome that can be used to achieve remote code execution.
Chrome Renderer Remote Code Execution
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
Rooting with root cause: finding a variant of a Project Zero bug
In this blog, I’ll look at CVE-2022-46395, a variant of Project Zero issue 2327 (CVE-2022-36449) and show how it can be used to gain arbitrary kernel code execution and root privileges from the untrusted app domain on an Android phone that uses the Arm Mali GPU. I used a Pixel 6 device for testing and reported the vulnerability to Arm on November 17, 2022.
How to fix a ReDoS
Although some ReDoS vulnerabilities can be very serious (particularly when they’re server-side and enable an untrusted remote attacker to DOS the server), very often they land much closer to the “annoying” end of the CVSS rating scale: not particularly serious, but easy to create by accident, obscure to understand, and sometimes tricky to fix. The most annoying thing about ReDoS vulnerabilities is that they’re not caused by careless coding, but by an obscure edge-case in the regex engine.
Pwning Pixel 6 with a leftover patch
The Christmas leftover patch In the year 2023 A.D., after a long struggle, N-day vulnerabilities, such as CVE-2022-33917, CVE-2022-36449, and CVE-2022-38181 had been fixed in the Pixel 6. Vendor drivers like the Arm Mali had laid their patches at Android’s feet. Peace reigns, disturbed only by occasional toddlers bankrupting their parents with food ordering apps. All patches from upstream are applied.1 All? No, one patch still stubbornly holds out.
Build a secure code mindset with the GitHub Secure Code Game
Fixing security-related issues in code is a different kind of problem solving, and we often see developers introducing more problems as they try to fix these issues. I understand this because I was once one of those developers. When I started to learn how to write functional code, I was asked to write a form that accepts user input. So, I made a form that accepts user input.
GitHub Security Lab audited DataHub: Here's what they found
At GitHub, we really care about open source security and love to help maintainers to secure their code. That is indeed the mission of the GitHub Security Lab. As users of open source software (OSS), we also love to contribute back to the community by helping improve the security posture of the OSS we use to build GitHub. That was the case when the GitHub Security Lab audited DataHub, an open source metadata platform that enables data discovery, data observability, and federated governance.
The code that wasn't there: Reading memory on an Android device by accident
In this post I’ll cover the details of CVE-2022-25664, a vulnerability in the Qualcomm Adreno GPU that I reported to Qualcomm in November 2021. The bug was a somewhat accidental find, and although it can only be used to leak information, it is nevertheless a very powerful bug that can be used to leak large amounts of information to a malicious Android app; it can be used an unlimited number of times with no adverse effects on the running state of the phone.
Bypassing OGNL sandboxes for fun and charities
Overview Object Graph Notation Language (OGNL) is a popular, Java-based, expression language used in popular frameworks and applications, such as Apache Struts and Atlassian Confluence. In the past, OGNL injections led to some serious remote code execution (RCE) vulnerabilities, such as the Equifax breach, and over the years, protection mechanisms and mitigations against OGNL injections have been developed and improved to limit the impact of these vulnerabilities.
Pwning the all Google phone with a non-Google bug
The “not-Google” bug in the “all-Google” phone The year is 2021 A.D. The first “all Google” phone, the Pixel 6 series, made entirely by Google, is launched. Well not entirely… One small GPU chip still holds out.
Creating a more inclusive security research field
Cybersecurity has grown in importance and mainstream understanding, thanks in part to the rise in headline-driving breaches and Hollywood’s depiction of “hackers” with their often nefarious undertakings. While many people have a general understanding of cybersecurity and a sense of its importance, there remains limited understanding of the careers available, with perceptions limited to technical roles in the space.
What we learned from the Security Lab’s Community Office Hours
Earlier this year, the GitHub Security Lab kicked off an initiative to provide office hours for open source projects looking to improve their security posture and reduce the risk of breach. The initiative aligned with our mission to inspire and enable the community to secure the open source software we all depend on. It also helped to address a well-expressed need in the open source community for security expertise.
Corrupting memory without memory corruption
In this post I’ll cover the details of CVE-2022-20186, a vulnerability in the Arm Mali GPU that I reported to the Android security team, which was fixed in the June update for Pixel. This bug exists in the memory management code of the Arm Mali GPU kernel driver, which is exploitable to map arbitrary physical pages to the GPU memory with both read and write access. This gives a very strong primitive that allows me to gain arbitrary kernel code execution and root on a Pixel 6 with ease.
The Chromium super (inline cache) type confusion
In this post I’ll exploit CVE-2022-1134, a type confusion in V8, the JavaScript engine of Chrome that I reported in March 2022, as bug 1308360 and was fixed in version 100.0.4896.60. This bug allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site. The bug exists in the super inline cache (SuperIC) feature, which has a history of exploitable vulnerabilities.
The Android kernel mitigations obstacle race
In this post, I’ll exploit a use-after-free (UAF) bug, CVE-2022-22057 in the Qualcomm GPU driver, which affected the kernel branch 5.4 or above, and is mostly used by flagship models running the Snapdragon 888 chipset or above (for example, the Snapdragon version of S21—used in the U.S. and a number of Asian countries, such as China and Korea— and all versions of the Galaxy Z Flip3, and many others).
Thinking beyond SQL injection: OWASP tips for secure database access
This is part three of GitHub Security Lab’s series on the OWASP Top 10 Proactive Controls, where I provide practical guidance for OSS developers and maintainers on improving your security posture. When you think about database security, the first thing that might come to mind is SQL injection. In 2022, SQL injection is a very well-known security vulnerability, as seen through projects such as the OWASP Top 10 risks or even XKCD’s now-famous “little Bobby Tables” cartoon.
How to leverage security frameworks and libraries for secure code
This is part three of GitHub Security Lab’s series on the OWASP Top 10 Proactive Controls, where I provide practical guidance for OSS developers and maintainers on improving your security posture. You should normally avoid implementing security-related controls from scratch unless you really know what you’re doing—doing so requires deep knowledge and expertise to implement them in a reliable and secure manner.
How to define security requirements for your OSS project
This is part two of GitHub Security Lab’s series on the OWASP Top 10 Proactive Controls, where I provide practical guidance for OSS developers and maintainers on improving your security posture. Defining your security requirements is the most important proactive control you can implement for your project. This prompts you to establish a base standard for your project to comply with and helps you get into a security mindset even before writing a single line of code.
Write more secure code with the OWASP Top 10 Proactive Controls
As software becomes the foundation of our digital—and sometimes even physical—lives, software security is increasingly important. But developers have a lot on their plates and asking them to become familiar with every single vulnerability category under the sun isn’t always feasible. Even for security practitioners, it’s overwhelming to keep up with every new vulnerability, attack vector, technique, and mitigation bypass.
Blue-teaming for Exiv2: how to squash bugs by enrolling in OSS-Fuzz
This is the final blog of a four-part series about how I am helping to harden the security of the Exiv2 project. This post is about how we enrolled Exiv2 in OSS-Fuzz, which is Google’s awesome fuzzing service for open source projects. Getting Exiv2 enrolled in OSS-Fuzz took more work than I originally imagined, but it was worth it. Going through the process led to the discovery of quite a few more bugs.
One day short of a full chain: Real world exploit chains explained
When it comes to security research, the path from bug to vulnerability to exploit can be a long one. Security researchers often end their research journey at the “Proof of Concept” (PoC) stage. A PoC is intended to trigger or exploit a vulnerability to demonstrate risk and impact, but without any real expectation of reliably compromising a targeted system. But how do such PoC research tools relate to the sophisticated attacks that make news headlines?
Fair election under threat as Joshua Wong cites foreign interference
Wednesday, October 23, 2019, 23:41 PDF View Revert PDF View Fair election under threat as Joshua Wong cites foreign interference By Man Mo Wednesday, October 23, 2019, 23:41 By Man Mo Demosisto Secretary-General Joshua Wong Chi-fung has announced he will be running for the upcoming District Council (DC) election in November.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Man
Contact Man, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack