Reliability is a promise your exploit makes to a machine it has never met, and on the Pwn2Own stage, that promise is put on the line. When the promise is broken, everyone wonders why, yet the answer is rarely discussed publicly. Is it an unpredictable garbage collector, a failed race condition, a version mismatch, a hardware discrepancy, a wrong environment setup, or just fate?
This talk shares our answer: the story of an Apple Safari renderer exploit with a near-100% success rate that failed on stage at Pwn2Own Berlin 2026, undone by a mere 2-bit variance.
We begin with a deep dive into the specific JavaScriptCore vulnerability we used in the competition, showing how it yields restricted primitives inside the Gigacage. We then present two novel, universal Gigacage-escape techniques that turn those primitives into full arbitrary memory read/write in the Safari renderer. From there, we walk through the engineering behind pushing our exploit's reliability to near 100%, and dissect the exact 2-bit discrepancy that ultimately caused it to fail on stage. Finally, we show a live demo against Apple Safari and share the lessons learned from this epic failure.
Edouard Bochin (@le_douds) is a security researcher at Palo Alto Networks who specializes in vulnerability research on both offensive and defensive fronts. He is the recipient of the 2024 Pwnie Award for Most Innovative Research and is a two-time Pwn2Own winner, PWNing Chrome and MSEdge browsers at Pwn2Own Vancouver 2024 and Firefox browser at Pwn2Own Berlin 2025. He is also a patent inventor and has notably spoken at Hexacon 2025, Black Hat USA 2024 and Virus Bulletin 2023.
Tao Yan (@Ga1ois) is a security researcher at Palo Alto Networks. He likes discovering new attack surfaces, exploring new research ideas and deep diving into system internals from both offensive and defensive perspectives. His interests include bug findings with dynamic fuzzing and static code analysis, exploits, mitigations bypass, sandbox escape and privilege escalation on various applications and OS components. He has also been involved with exploits, APTs, malware detection and defense. He has been listed as #7 and #4 researcher in 2016 and 2017 for MSRC Most Valuable Researchers. He is also the winner of the Windows local escalation of privilege category in Pwn2Own 2021, the Chrome/MSEdge browser category in Pwn2Own 2024 and the Firefox browser category in Pwn2Own 2025. He has achieved the Pwnie Awards for Most Innovative Research in 2024. In addition, he is a regular security patent inventor and security conference speaker including Black Hat (USA, EU, Asia, MEA), CanSecWest, Hexacon, BlueHat, VirusBulletin, ReCon, POC, HITCON, etc.
