I've opened up the five VirtualBox issues in the PZ tracker. 4 of them are bypasses of the VB process hardening (including one which is a broken fix from 2019 due to changes in Windows).
Of most interest perhaps is the bug which abused .NET https://project-zero.issues.chromium.org/issues/544666197. This uses the same root cause that MS fixed in https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398, just VB made it trivial to abuse, just get the hardened process to load a .NET COM object from an AnyCPU file and it'll bypass the checks.
Of course how you can turn that into a WDAC and PPL bypass, is interesting on its own :D
James Forshaw :donor:
npub1wp…sejcr
2026-10-15 10:35:42 UTC
Author Public Key
npub1wp4gyc9xmkjxl0vpxpmv0hmsw25uyhvwnynewn5mrj8s66v8ku6sesejcrSeen on
wss://relay.momostr.pinkPublished at
2026-10-15 10:35:42 UTCEvent JSON
{
"id": "a9f9aabedd06c387800065cf8fb9f33cb301e1c76558ccda6b190c7e5ac5d123",
"pubkey": "706a8260a6dda46fbd813076c7df7072a9c25d8e9927974e9b1c8f0d6987b735",
"created_at": 1792060542,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@tiraniddo/117444479703080023",
"web"
],
[
"proxy",
"https://infosec.exchange/users/tiraniddo/statuses/117444479703080023",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/tiraniddo/statuses/117444479703080023",
"pink.momostr"
],
[
"-"
]
],
"content": "I've opened up the five VirtualBox issues in the PZ tracker. 4 of them are bypasses of the VB process hardening (including one which is a broken fix from 2019 due to changes in Windows). \n\nOf most interest perhaps is the bug which abused .NET https://project-zero.issues.chromium.org/issues/544666197. This uses the same root cause that MS fixed in https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398, just VB made it trivial to abuse, just get the hardened process to load a .NET COM object from an AnyCPU file and it'll bypass the checks.\n\nOf course how you can turn that into a WDAC and PPL bypass, is interesting on its own :D",
"sig": "b1f0fb4e92287d391547aa648633b9cc6788335d054dbaa64ce81015a3dc6225f4e386457d2709fa7cdeaf01c1f919b82707a26d8d84506c52b194a751035899"
}