# Hackicker

> Offensive security audits backed by independent vulnerability research. Public findings, upstream fixes, and technical writing by Warisjeet Singh (sin99xx), with original sources attached.

The public record contains 5 credited NoScript / Tor Browser vulnerability findings, 7 assigned CVEs disclosed from 2025-04-14 through 2026-08-24, 4 upstream fixes, and 11 technical articles. Research subjects include NoScript, Tor Browser, QEMU, Exim, Google Gemini for iOS, Joomla, Go, and XNNPACK / LiteRT. These are research subjects, not a customer or endorsement list.

Audit inquiries: founders@hackicker.com. Security reports: security@hackicker.com. The site uses no cookies, analytics, forms, or visitor profiles.

## Start here

- [Security audits](https://hackicker.com/): backed by independent research
- [Research catalogue](https://hackicker.com/findings): credited vulnerability findings, assigned CVEs, upstream fixes, and program record
- [Reading room](https://hackicker.com/writing): published articles with summaries and source links
- [Full public content in plain text](https://hackicker.com/llms-full.txt): findings, verbatim evidence excerpts, source links, writing summaries, and policies

## Credited vulnerability findings

- [Tor Browser / NoScript: content-patch propagation](https://hackicker.com/findings#noscript-patch-propagation): NoScript 13.6.35 Tor Browser 15.0.24 released 2026-09-29 Fixed ✓
- [Tor Browser / NoScript: onion-alias policy matching](https://hackicker.com/findings#noscript-onion-aliases): NoScript 13.6.35 Tor Browser 15.0.24 released 2026-09-29 Fixed ✓
- [NoScript: IPv4 policy matching](https://hackicker.com/findings#noscript-ipv4-matching): NoScript 13.6.34 Fixed ✓
- [Tor Browser / NoScript: SharedWorker identity mismatch](https://hackicker.com/findings#noscript-sharedworker-identity): NoScript 13.6.33 Tor Browser 15.0.23 released 2026-09-15 Fixed ✓
- [Tor Browser / NoScript: missing HTML policy hook](https://hackicker.com/findings#noscript-html-policy-hook): NoScript 13.6.33 Tor Browser 15.0.23 released 2026-09-15 Fixed ✓

## Public CVE reports

- [CVE-2026-77913: QEMU VGA text: out-of-bounds write](https://hackicker.com/findings/cve-2026-77913): disclosed 2026-08-24
- [CVE-2026-18204: QEMU usb-ccid: out-of-bounds read](https://hackicker.com/findings/cve-2026-18204): disclosed 2026-07-29
- [CVE-2026-17516: QEMU VGA: heap out-of-bounds write](https://hackicker.com/findings/cve-2026-17516): disclosed 2026-07-28
- [CVE-2026-48956: Joomla core: incorrect access control](https://hackicker.com/findings/cve-2026-48956): disclosed 2026-07-10
- [CVE-2026-48840: Exim: pre-authentication stack leak](https://hackicker.com/findings/cve-2026-48840): disclosed 2026-05-29
- [CVE-2026-48004: QEMU device emulation: heap use-after-free](https://hackicker.com/findings/cve-2026-48004): disclosed 2026-05-20
- [CVE-2025-5009: Google Gemini for iOS: conversation disclosure](https://hackicker.com/findings/cve-2025-5009): disclosed 2025-04-14

## Upstream fixes

- [Go: crypto/tls](https://hackicker.com/findings#go-cl-789862): Google opened 2026-06-11 merged in 6 days Merged ✓
- [XNNPACK / LiteRT: heap out-of-bounds write](https://hackicker.com/findings#xnnpack-pr-10464): Google opened 2026-06-11 merged in 21 days Merged ✓
- [XNNPACK: out-of-bounds read](https://hackicker.com/findings#xnnpack-pr-10463): Google opened 2026-06-11 merged in 21 days Merged ✓
- [XNNPACK: heap out-of-bounds write in CONCATENATE](https://hackicker.com/findings#xnnpack-pr-10373): Google opened 2026-06-02 merged in 1 day Merged ✓

## Selected primary sources

- [NoScript changelog](https://noscript.net/changelog/)
- [Tor 15.0.24 release](https://blog.torproject.org/new-release-tor-browser-15024/)
- [Tor 15.0.23 release](https://blog.torproject.org/new-release-tor-browser-15023/)
- [QEMU work item #4085](https://gitlab.com/qemu-project/qemu/-/work_items/4085)
- [QEMU work item #4215](https://gitlab.com/qemu-project/qemu/-/work_items/4215)

## Researcher and profiles

- [Warisjeet Singh (sin99xx)](https://sin99xx.com/): researcher credited on the public findings
- [GitHub](https://github.com/sin99xx)
- [Medium](https://sin99xx.medium.com)
- [X](https://x.com/sin99xx)
- [HackerOne](https://hackerone.com/sin99xx)
- [GitLab](https://gitlab.com/sin99xx)

## Optional

- [Privacy policy](https://hackicker.com/privacy): hosting request data, email correspondence, and deletion requests
- [Security disclosure](https://hackicker.com/disclosure): reporting scope, 48-hour acknowledgment, 7-day assessment, 90-day upstream window, and safe harbor
- [Security contact details](https://hackicker.com/.well-known/security.txt): machine-readable reporting address and expiry date
- [Atom feed](https://hackicker.com/feed.xml): credited finding updates and published writing
- [JSON Feed](https://hackicker.com/feed.json): the same research and writing in JSON Feed format
- [Sitemap](https://hackicker.com/sitemap.xml): canonical public pages
- [Crawler access policy](https://hackicker.com/robots.txt): search and AI crawler access