NDevTK
@ndevtk
Followers
1K
Following
822
Media
8
Statuses
317
Still pretending to be a security researcher.
Joined September 2021
Bug write-up for "Controlling the Google Assistant via Web Speech API" *^____^*.
ndevtk.github.io
When the Google Assistant is opened with a deeplink it should require manually pressing on the microphone icon to start listening per https://feed.bugs.xdavidhu.me/bugs/0011 (unless “OK Google” is...
3
8
71
My YouTube channel is now un-deprecated 🎉.Android lock screen data leak Minecraft video PoC can now be found at
0
0
4
Been automating chromium security research using AI agents with codebase learning, VRP insights and research tracking tools. While the agent will remain private there's a nice tool for interfacing with chromium services now with V8 support 🥳.
github.com
Command to list files in directory Support V8 for file lookup Support devtools for file lookup Support webrtc for file lookup ...etc
0
2
13
Bug write-up for "Cameyo XSS" ☆*: .｡. o(≧▽≦)o .｡.:*☆.
ndevtk.github.io
XSS on Cameyo’s Virtual App Delivery platform (alternative to VDI & DaaS) an TIER0 Google acquisition per https://github.com/google/bughunters/blob/d1d112929c1e10ce86ec5686fa81eb1f828dd019/domain-t...
1
7
50
OriginMarker (Origin dependent marker) version 1.4 chrome extension is released now with pre-set Markers for common websites strangely not given up with the extension yet.
0
0
1
¯\_(ツ)_/¯.
“Leaks sensitive (if user disables notification content on lockscreen) app contents like discord messages” and even WhatsApp or Telegram chats, It’s possible yet, It’s still without fixing on Android 16.
0
0
1
Bug write-up for "Android lock screen data leak" ╰(*°▽°*)╯.
ndevtk.github.io
Due to a lock screen race its possible to leak interactive app contents since app launches show on the lock screen temporarily.
3
28
146
Used an LLM to create extra themes for I noticed the base64 theme was to easy to read so there's now a emoji option which further encodes the output.
ndevtk.github.io
Vulnerabilities affecting the web platform
1
0
2
Decided to skip testing and deploy the following: the console.log now has a space :) Shortcut partitioning, a threat model I made up. added a feature to ask for permission. API just crashes 🦆.
1
2
15
Quack Quack Quack my legacy Minecraft mod is now open source I still don't know Java just search for "intent://" URLs. 🦆.
github.com
A Minecraft mod. Contribute to NDevTK/MCMod development by creating an account on GitHub.
0
0
3
It appears with Gemini 2.5 pro creating an LLM wiki for chromium security research is a lot more practical. Does anyone want to collaborate on this? in return you may find a bug! Otherwise I will go back to the random post about XSS system.
0
1
5
Testing the new Chrome ai.summarizer API for the summarizer theme on its patched so that COOP isn't "Connection Orca Protection" but still unreliable.
0
0
3
My NEW favorite popunder!.
0
0
12
Bug write-up for "EqualWeb UXSS" I prefer Google VRP.
ndevtk.github.io
The Web Accessibility Library from EqualWeb that’s used by companies such as https://www.equalweb.com/8600/11527/our_customers had an XSS flaw in its AI powered dictionary feature this was attackable...
0
4
59