Uploaded February 2026 | Updated September 2026, 2 weeks ago

---

What happens in the Pwn2Own disclosure room? Let's find out in part 2 of my short documentary about how Mozilla fixes zero-days.


LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Join the Hextree Discord: discord.gg/xgQpCQCpvy

Part 1: youtube.com/watch?v=YQEq5s4SRxY
Part 2: youtube.com/watch?v=uXW_1hepfT4
Part 3: youtube.com/watch?v=NT1VCmJF3mU
Part 4: youtube.com/watch?v=x4CUAuwoZVk

(Spoilers) Firefox Security Response to Pwn2Own 2025: blog.mozilla.org/security/2025/05/17/firefox-security-response-to-pwn2own-2025

CHAPTERS
00:00 - Heading into the disclosure room
01:54 - Waiting for ZDI to validate the submission
02:29 - Entering the room and sharing the exploit
02:46 - Promise.allSettled out-of-bounds write
04:20 - Reproducing and trying to bisect the bug
05:31 - Exploit stability and Firefox differences
07:20 - Leaving the disclosure room for Mozilla
08:21 - Coordinating the security incident
09:28 - ESR, Tor Browser, and six-year bisection
10:46 - Studying the exploit and improving fuzzing
11:49 - A prototype patch and variant search
12:24 - Why an open-source patch cannot land yet
13:14 - Risk assessment and overnight handoff
14:16 - Waiting for the second Firefox exploit

SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com

WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog

#Pwn2Own #Firefox #LiveOverflow

(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.