Toan Pham
@__suto · Security Researcher
I find and exploit vulnerabilities in browsers and devices. I've reported bugs in Internet Explorer, Google Chrome, Apple Safari, Mozilla Firefox and Adobe Reader, and won several Pwn2Own competitions targeting Samsung, Sonos and various IoT devices.
Selected CVEs
-
Google Chrome
CVE-2024-0517 · $16,000 + $10,000 v8CTF winner · renderer RCE
CVE-2024-0222 · CVE-2024-0223 · $15,000 each · GPU RCE -
Mozilla Firefox
CVE-2025-13024 · $5,000 · renderer RCE
CVE-2026-12297 · $20,000 · sandbox escape - Apple SafariCVE-2022-22590 · $0 · no PAC bypass, so no RCE — chasing a new one
- Adobe Reader CVE-2017-16360 · CVE-2017-16362 · CVE-2017-16363 · CVE-2017-16364 · CVE-2017-16365 · $2,000 each
- Internet Explorer CVE-2013-3145 · CVE-2013-3146 · CVE-2013-3151 · $10,000 each · renderer RCE
Pwn2Own
- SamsungGalaxy S23 hacked with a million-dollar zero-day
- SonosExploiting the Sonos One speaker three different ways
Notes
★ Some of the bugs above were found together with Tri, zx and Lan — my hacking brothers and sister, and researchers I'm honored to work alongside.
Every one of these would clear five to ten times more on the gray market. I sold to the vendors instead — to the people who patch, not the people who deploy.
And a hacker just handed you the list of links below. You, of all people, know better than to click them — select, copy, paste, and trust nothing. Not even me.
References
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop_16.html
- https://chromereleases.googleblog.com/2024/01/stable-channel-update-for-desktop.html
- https://www.mozilla.org/en-US/security/advisories/mfsa2025-87/#CVE-2025-13024
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-57/#CVE-2026-12297
- https://support.apple.com/en-us/103172
- https://helpx.adobe.com/security/products/acrobat/apsb17-36.html
- https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055
- https://www.forbes.com/sites/daveywinder/2023/10/28/samsung-galaxy-s23-hacked-by-million-dollar-zero-day-attackers/
- https://www.thezdi.com/blog/2023/5/24/exploiting-the-sonos-one-speaker-three-different-ways-a-pwn2own-toronto-highlight