Toan Pham

I find and exploit vulnerabilities in browsers and devices. I've reported bugs in Internet Explorer, Google Chrome, Apple Safari, Mozilla Firefox and Adobe Reader, and won several Pwn2Own competitions targeting Samsung, Sonos and various IoT devices.

Selected CVEs

• Google Chrome CVE-2024-0517 · $16,000 + $10,000 v8CTF winner · renderer RCE
  CVE-2024-0222 · CVE-2024-0223 · $15,000 each · GPU RCE
• Mozilla Firefox CVE-2025-13024 · $5,000 · renderer RCE
• Apple SafariCVE-2022-22590 · $0 · no PAC bypass, so no RCE — chasing a new one
• Adobe Reader CVE-2017-16360 · CVE-2017-16362 · CVE-2017-16363 · CVE-2017-16364 · CVE-2017-16365 · $2,000 each
• Internet Explorer CVE-2013-3145 · CVE-2013-3146 · CVE-2013-3151 · $10,000 each · renderer RCE

Pwn2Own

• SamsungGalaxy S23 hacked with a million-dollar zero-day
• SonosExploiting the Sonos One speaker three different ways

References

Every one of these would clear five to ten times more on the gray market. I sold to the vendors instead — to the people who patch, not the people who deploy.

And a hacker just handed you a list of links. You, of all people, know better than to click them — select, copy, paste, and trust nothing. Not even me.

• https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html
• https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-87/#CVE-2025-13024
• https://support.apple.com/en-us/103172
• https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
• https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055
• https://www.forbes.com/sites/daveywinder/2023/10/28/samsung-galaxy-s23-hacked-by-million-dollar-zero-day-attackers/
• https://www.thezdi.com/blog/2023/5/24/exploiting-the-sonos-one-speaker-three-different-ways-a-pwn2own-toronto-highlight