Pwn2Own 2024–2025 research roundup

Pwn2Own 2024–2025 research roundup

TL;DR: Pwn2Own contests in 2024 and 2025 (Vancouver, Toronto, Ireland, Tokyo Automotive) collectively produced several hundred bug chains against modern browsers, virtualisation, OS, mobile, consumer router/NAS, ICS, and electric-vehicle infotainment targets. Studying the published advisories and post-contest writeups is the highest-density way to keep current on what state-of-the-art exploit research actually looks like. Companion to browser-exploitation-primer and osee-roadmap.

Why study Pwn2Own

  • Contests cap research to public, working chains — not theoretical.
  • Vendors are on-site and patches ship within 90 days; the writeups become reproducible.
  • Categories sweep most of the OSEE-adjacent target list: browsers, VM escapes, kernels, mobile, embedded.
  • ZDI publishes advisories with technical detail; Synacktiv, Theori, Cluck, REverse Tactics, STAR Labs, others publish their own talks.

If you want to know “what does a working chain look like in 2025”, here is the corpus.

Categories and recurring patterns

Browsers

  • Chrome / Edge — JIT type confusion in V8, sandbox escape via Mojo IPC or GPU process.
  • Safari (JSC) — JIT-induced UAF or type-confusion, then arbitrary R/W primitives, then macOS kernel chain.
  • Firefox — fewer modern wins; when present, often DOM UAF + sandbox.

Common chain shape: renderer arb-r/w → sandbox escape via IPC bug → optional kernel for full system. See browser-exploitation-primer.

Virtualisation

  • VMware Workstation / ESXi — host-from-guest via uhci / xhci / vmxnet3 device emulation. UAF in device frontend.
  • VirtualBox — similar device-frontend bugs.
  • Hyper-V — recent advances; rare but high-bounty wins.
  • Parallels Desktop on macOS — guest-to-host via shared-folder / network adapter.

Recurring class: device-frontend parsing in emulator is C/C++, attacker-controlled bytes from guest driver, classic memory corruption.

OS / kernel

Mobile

  • Android / Pixel — Pixel-only bugs in Mali GPU driver or Trusty TEE.
  • iPhone / iOS — Safari renderer + sandbox + kernel chain. Multi-stage.
  • Samsung Galaxy — vendor framework bugs (Knox, S Pen, baseband).

Enterprise + cloud

  • VMware vCenter / vSphere — server-side parsing or RPC bugs.
  • Microsoft Exchange / SharePoint — when included; auth bypass + post-auth RCE.
  • Container / Kubernetes (newer category) — runtime escapes, admission webhook abuse.

ICS / SCADA

  • Multi-day contest in Miami; categories include OPC UA, EtherNet/IP, Modbus, gateway products. Lots of unauth memory corruption.

Automotive

  • Tesla, Sony, Pioneer infotainment — Bluetooth / Wi-Fi / USB → infotainment RCE → CAN bridge attempts.
  • Tesla wins in 2024 paid $700k+ for chains crossing infotainment → vehicle bus.

Consumer router / NAS

  • Synology, QNAP, NETGEAR, TP-Link — pre-auth RCE on management interfaces, often classic stack overflow or command injection.

What the chains have in common

Almost every winning chain involves:

  1. A memory corruption or logic bug for initial code execution in a sandbox or low-privilege context.
  2. A sandbox escape or LPE to get out of that boundary.
  3. Optionally a persistence / cleanup primitive.

The class of (1) varies: JIT type confusion (browsers), UAF (kernel / virt), heap overflow (consumer firmware), logic bug (auth bypass).

The class of (2) is increasingly:

  • Win32k.sys callbacks for Windows.
  • Mojo IPC / GPU process for Chromium.
  • Mach IPC for macOS / iOS.
  • BPF verifier for Linux.

Useful sources to read

  • ZDI advisories index — zerodayinitiative.com/advisories/published/. Has CVEs for each Pwn2Own win after the 90-day window.
  • ZDI blog — long-form analyses of selected entries.
  • Synacktiv blog — winners many years; detailed writeups.
  • Theori blog — kernel / sandbox-heavy writeups.
  • STAR Labs blog — virtualisation and mobile.
  • REverse Tactics — automotive.
  • Pwn2Own master schedule and results on ZDI’s site for each contest.

After each contest, set aside time to read the winners’ writeups within a week. The half-life of relevance is short.

How to use this for your own training

If you want to ladder toward OSEE / professional exploit development:

  1. Pick a category that overlaps your target stack.
  2. Read 5 writeups in depth (not 50 shallow).
  3. Reproduce one end-to-end in a lab.
  4. Variant-hunt in the same code area for a similar bug the patch may have missed.

See osee-roadmap for sequencing.

Patches and where to find them

ZDI advisories link to vendor patch references. Pwn2Own vendors must patch within 90 days, so:

This produces high-quality 1-day candidates with public root-cause material.

What’s hard about copying winners

  • You’re competing with full-time research teams (Synacktiv, STAR Labs, Theori).
  • The bugs that win are often found via N-month fuzzing campaigns.
  • The chains depend on intimate knowledge of internals you build over months of debugger time.

For learners: the value is the method, not the win. Reading the writeup teaches you to think the way the winner thought.

References