Not All Firefox Bugs Are Equal: Heap Grief and CFG Bypass
Koh Kian Woon examines as AI accelerates development and increases system complexity, robust defence-in-depth and deep technical expertise are becoming increasingly critical for defenders.
Summary
Architecture and Background
Koh Kian Woon present 'Not All Firefox Bugs Are Equal: Heap Grief and CFG Bypass' at DEF CON SG1 CSIT Village, detailing technical frameworks, attack surfaces, and core methodologies in browser-exploitation, heap-exploitation, cfg-bypass, vulnerability-research.
Vulnerability Analysis
The technical analysis dissects structural design flaws, protocol vulnerabilities, and edge cases uncovered during rigorous research.
Exploitation and Demonstrations
As AI accelerates development and increases system complexity, robust defence-in-depth and deep technical expertise are becoming increasingly critical for defenders. This talk highlights that effective security requires going beyond severity ratings to truly understanding threats and to prioritise real-world exploitability.
Remediation and Defensive Strategies
Security practitioners and defenders receive actionable defensive controls, hardened configurations, and threat detection strategies to mitigate impact.
Related talks
Main Stage·42 min
Jacob Baines
Presents a practical exploitation guide for finding and exploiting memory corruption vulnerabilities in network security devices and embedded Linux systems.
CSIT Village·38 min
Ernest Ang
Ernest Ang explores from chrome renderer, to mouse, to system at DEF CON SG1, examining browser-exploitation and practical defenses.
CSIT Village·30 min
Chua Meng Han
Chua Meng Han examines critical vulnerabilities like CVE-2025-52691 remind us that “low-hanging fruit” still exists today.