Day: ?? . Time: ?? SGT
TBA
Dr. Edward PengHuazhong University of Science and Technology (HUST)
0x00//PROGRAMME — TALK BOARD
The Line-Up
// one single track.
More talks to come. Reviewed by a peer-review board of practising researchers. Click any talk for details — share the link with a colleague.
Day: ?? . Time: ?? SGT
The Chaos Phase or How I Learned to Stop Worrying and Love Offensive AI
Nico WaismanXBOW
Day: ?? . Time: ?? SGT
I Let A.I. Loose on Google. It Found RCE. Twice.
Arvin ShivramBrutecat Security Pte Ltd
Day: ?? . Time: ?? SGT
From CloseHandle to Code Execution: Exploiting an arbitrary handle close vulnerability for EOP
Arjun VasudevaMicrosoft
Day: ?? . Time: ?? SGT
Chaining Logical Bugs for Reliable Windows LPE
Bocheng Xiang , HeeChan KimFudan University · Soongsil University
Day: ?? . Time: ?? SGT
Beyond XNU: Agentic Hunting for Vulnerabilities in TXM
Stefan EsserCalif
Day: ?? . Time: ?? SGT
No Time to Pwn2Own: Exploiting After the Draw
Evangelos Daravigkas , Ben KooTeam DDOS
Day: ?? . Time: ?? SGT
The Singularity Doesn't Care About Leaking Your Data From Prompt Injection to Posthuman Recon: A Field Report on Attacking AI in 2026
Markus VervierPersistent Security, X41 D-Sec GmbH
Day: ?? . Time: ?? SGT
Rooting the Google Pixel 10 with old-school techniques
Wang Yong-
Rooting the Google Pixel 10 with old-school techniques
// Abstract
The Google Pixel 10 features the new Tensor G5 SoC, which uses the PowerVR GPU instead of the Mali GPU. However, the PowerVR GPU is far from new. Numerous bugs have been discovered in PowerVR driver over the past few years[1][2]. Is it possible to find exploitable vulnerabilities and root the Pixel 10 within a limited timeframe? I decided to find out.
In this talk, I will first provide an overview of the PowerVR GPU. I will then walk through my methodology for identifying logic bugs under tight time constraints. Next, I will detail the black-box approach for uncovering a limited write primitive. Finally, I will detail how to turn the limited write primitive into arbitrary read/write access to kernel physical memory.
During the presentation, I will give an exploit demonstration of rooting a Google Pixel 10 device. In summary, the exploitation ideas presented in this talk have not been covered in previous public presentations.
[1] https://blackhat.com/us-22/briefings/schedule/index.html#android-universal-root-exploiting-mobile-gpu--command-queue-drivers-27239
[2] https://project-zero.issues.chromium.org/issues?q=status:(open%20%7C%20closed%20%7C%20fixed)%20powervr
// Speakers
Wang Yong
-
Yong Wang(@ThomasKing2014) is a Senior Security Researcher. He was a speaker at several security conferences including Black Hat(Asia, Europe, USA), HITB Amsterdam, Zer0Con, POC, CanSecWest, MOSEC and QPSS. Over the years, he has reported several vulnerabilities, and one of them was nominated for Pwnie Award 2019.