Closing the security gap as intelligence advances.
The advantage belongs to those who act first
MacroBrick’s approach
MacroBrick Frontier Security Architecture
Find gaps. Close the loop. Stay ahead.
Frontier intelligence is changing how software is built and how vulnerabilities are found. As systems grow more complex, security research needs to evolve with them.
MacroBrick is an independent security research company uncovering critical-impact vulnerabilities across products, runtimes, and the systems around them through direct engagements and deep research, turning complex findings into real-world impact.
Our work reaches the software people use every day. Across browsers, enterprise products, and complex client systems, we investigate vulnerabilities that can cross meaningful security boundaries.
With 140+ engagements delivered and 35+ vendor-assigned CVEs, our research is grounded in reproducible findings and practical remediation.
An isolated bug is only part of the story. We examine how data moves, where trust changes, and how multiple behaviors can connect into an exploitable path.
That means looking beyond a scanner result: following the code, reproducing the behavior, and understanding what an attacker could actually achieve.
Intelligent tooling expands the scale of discovery and the speed of investigation. A periodic review leaves too much time between a system changing and a weakness being understood. We combine intelligent analysis with hands-on research to shorten that gap, while keeping evidence and engineering judgment at the center of the work.
01 / The approach
Security becomes stronger when discovery, investigation, and remediation work as one continuous operation. MacroBrick brings intelligent research and deep technical expertise into that loop: mapping systems, finding weaknesses, proving impact, and supporting the people who make the fix.
The goal is practical. Less time lost to repeated investigations. Better context for engineers. A security outcome that can be independently checked.
The tools and engineering systems you already rely on.
GitHub · GitLab
Scanners · fuzzers · observability
Jira · Linear · GitHub Issues
A continuous research operation connecting your tools, system context, and the people who can make a fix.
Intelligent analysis · automated investigation · expert review
Discover · validate · remediate
System-specific researchSource reasoning · system understanding
Exploit development · root-cause analysis
Isolated, reproducible systems for investigating vulnerabilities and verifying fixes
Reliable research needs the real code, the right dependencies, and an environment where findings can be reproduced. Clear boundaries and shared context let that work scale without losing the evidence.
The tools researchers need to investigate.
Coordinate execution, permissions, and sensitive context.
Isolated environments for reproducible investigations.
Connect assets, evidence, owners, and remediation.
Keep investigations observable, access scoped, and consequential changes reviewable.
| Workflow | A familiar bottleneck | What the research loop adds | |
|---|---|---|---|
| Discovery | Signals accumulate across disconnected tools. | Context connects findings into a clear attack surface. | |
| Validation | Reports need further investigation. | Reproductions establish impact and exploitability. | |
| Ownership | Issues move between teams without context. | The right owner receives an actionable report. | |
| Remediation | A patch addresses the immediate symptom. | Root-cause analysis guides a durable security fix. | |
| Verification | An issue closes when a patch is merged. | Retesting checks the fix against real behavior. |
02 / MacroBrick case study
The most useful research carries a finding all the way through its lifecycle. Our work across browser engines, enterprise products, and client software has shaped a process that follows the evidence from an initial lead to a confirmed security outcome.
“A vulnerability report is the beginning. The outcome is a fix that holds up, an engineering team that understands the failure, and a system that is harder to attack.”
The MacroBrick research philosophy
Every investigation builds on what came before. System maps, reproduction steps, ownership context, and regression checks become reusable knowledge for the next pass.
Shared context connects every stage. Researchers preserve what they learn about the system, the vulnerability, and the fix so future investigations can focus on new behavior and unresolved risks.
A finding should come with the environment, inputs, and steps needed to demonstrate its behavior. We distinguish a confirmed vulnerability from a promising lead and a test that could not run. Engineers can act with more confidence when they can see the failure themselves.
A patch is more durable when it addresses the root cause. We trace the assumptions that failed, inspect related code paths, and consider what a future change might reintroduce. The work should leave a stronger boundary, with a regression check that explains why it exists.
Research has value when it reaches a real fix. We provide a clear account of impact, reproducible evidence, and technical context that helps engineering teams choose a remediation. Follow-up testing checks whether the original attack path remains reachable.
This approach has supported the remediation of more than 120 vulnerabilities across our research and engagements.
Experience across vendors helps us recognize patterns without assuming every system behaves the same way. Browser engines, client applications, and enterprise systems each demand a different understanding of their data flows, privileges, and failure modes.
Our work spans more than 11 vendors, including research in software from Google, Mozilla, Apple, and Microsoft.
You work directly with the people investigating your system. We focus on technical depth, concise communication, and concrete decisions—what is exploitable, what needs to change, and how to verify that the change worked.
MacroBrick has been building that practice since 2023.
03 / Reference architecture
Five connected workflows turn a changing attack surface into an actionable research process. Explore the inputs, investigation steps, and evidence that move each stage forward.
Connect your cloud assets, source repositories, deployed services, and ownership records into one system map. Establish what is in scope, where trust boundaries sit, and which teams can make a fix. Every investigation starts with a clearer picture of the system.
Swipe to explore the full workflow.
Infrastructure · exposed services
Repositories · build and runtime config
Service catalog · code owners
Researcher-led intelligent analysis
Map assets and trust boundaries
Research skillConnect code to accountable teams
Research skillA living system map, with ownership and evidence.
Selected public disclosures
Our research reaches widely used software. These vendor-assigned disclosures reflect the same practice we bring to engagements: understand the system, reproduce the failure, and help the fix reach users.
Featured zero day
Exploited in the wild
A use-after-free in Blink's style engine, reachable from ordinary page content and exploited in the wild before the fix reached stable. Added to the CISA Known Exploited Vulnerabilities catalog.
Scores use the available CVSS rating listed by NVD. Full writeups are shared with clients under NDA; public advisories are listed once the fix has reached stable.
Incorrect boundary conditions in the Graphics: WebGPU component, reachable from web content. Rated high impact by Mozilla and tracked as Bug 2059929.
Integer overflow in SpiderMonkey's OrderedHashTable, reachable from JavaScript. Fixed in Firefox 139.0.4. Rated Critical by NVD.
Type confusion in V8 allowing heap corruption from a crafted HTML page. Fixed in Chrome 138.0.7204.168.
A second type-confusion path in V8, patched in the same 138.0.7204.168 release.
Integer overflow in V8 leading to heap corruption via a crafted HTML page. Fixed in Chrome 138.0.7204.157.
Arithmetic overflow in the JavaScript engine leading to out-of-bounds memory access from script.
Unchecked bounds in V8 allowed both read and write primitives into renderer heap memory.
Reachable through WebRTC media handling in WebKit. Fixed across Safari 26.6, iOS/iPadOS 26.6 and 18.7.10, macOS Tahoe 26.6, and tvOS/visionOS/watchOS 26.6.
Lifetime bug in the Federated Credential Management implementation, triggerable during identity flows.
Dangling reference in the extensions subsystem reachable through a crafted extension or extension API interaction.
Web3 · Ethereum
Deleting a single element of a byte array in memory could clear 32 bytes instead of one, corrupting adjacent array contents or the next memory allocation. The defect affected Solidity’s default evmasm pipeline through version 0.8.36.
Reported by MacroBrick through the Ethereum Foundation’s bug bounty program. Published September 10, 2026.
Read the Solidity security advisorydelete bytesInMemory[i];The fix emits a single-byte store. The IR pipeline is unaffected.
Research in the spotlight
The work behind a browser zero day, brought into view. Watch Low Level explore the CSS vulnerability, the browser internals involved, and why careful security research matters.
04 / Getting started
Start with the system that matters most. Align on the threat model, choose a focused research scope, and build from confirmed findings toward a repeatable security practice.
Bring your product, architecture, and security priorities. We work with you to identify high-value boundaries and define a useful first engagement.
Discuss your scopeWork directly with researchers to explore the attack surface, reproduce high-impact weaknesses, and understand the failures behind them.
Explore our researchMove findings into practical remediation, retest the important changes, and preserve the knowledge that makes the next cycle stronger.
Work with MacroBrickHave a specific system or an urgent finding? Talk directly with our research team.