https://breachwomp.pages.dev/Independent security research focused on Android, mobile applications, web applications, APIs, reverse engineering, and practical vulnerability research.enhttps://breachwomp.pages.dev/log/trust-boundary-reading-note/https://breachwomp.pages.dev/log/trust-boundary-reading-note/A reading note on the existing WebView research: record which documents can reach a native bridge, and why they are trusted.Sat, 10 Oct 2026 00:00:00 GMTAndroidWebViewResearch noteshttps://breachwomp.pages.dev/research/bluehammer-from-zero-day-to-weaponized-malware/https://breachwomp.pages.dev/research/bluehammer-from-zero-day-to-weaponized-malware/We found BlueHammer exploit logic inside a malware sample — another sign that CVE-2026-33825 had moved from public research into real-world offensive tooling.Mon, 24 Aug 2026 00:00:00 GMTMalwareWindowsBlueHammerCVE-2026-33825Zero-DayPrivilege EscalationThreat Researchhttps://breachwomp.pages.dev/writeups/vendor-b-password-reset-account-takeover/https://breachwomp.pages.dev/writeups/vendor-b-password-reset-account-takeover/How a broken password-reset flow exposed recovery secrets to unauthenticated users and turned account recovery into a complete account-takeover primitive.Thu, 20 Aug 2026 00:00:00 GMTWebAPIAuthenticationAccount TakeoverPassword ResetInformation Disclosurehttps://breachwomp.pages.dev/writeups/vendor-a-nextjs-cloudfront-session-leak/https://breachwomp.pages.dev/writeups/vendor-a-nextjs-cloudfront-session-leak/How a shared CloudFront cache exposed an HttpOnly session credential embedded in server-rendered Next.js responses.Wed, 19 Aug 2026 00:00:00 GMTWebNext.jsCloudFrontSession ManagementCDNInformation Disclosurehttps://breachwomp.pages.dev/research/webview-native-bridges/https://breachwomp.pages.dev/research/webview-native-bridges/A short field note on why WebView-to-native interfaces deserve careful threat modeling.Wed, 19 Aug 2026 00:00:00 GMTAndroidWebViewMobileResearch