google/security-research
Security Research
This is a public archive of vulnerability findings, proof-of-concept code, and technical reports detailing security flaws discovered in third-party software. It functions as a coordinated vulnerability disclosure platform, enabling private reporting to vendors and structured publication of advisories after a fix is released or a 90-day deadline passes.
The repository provides modular security analysis tooling—standalone scripts and binaries each targeting a specific bug class for automated detection—alongside a cross-platform fuzzing framework that runs tests across multiple operating systems and architectures. It also maintains a threat intelligence archive that aggregates bug pattern data and exploit characteristics for longitudinal security trend analysis.
The collection is organized through a structured advisory portal with metadata for severity, affected versions, and patch status, and includes executable exploit code alongside advisory documents for reproducible vulnerability verification. The documentation and install surface is oriented toward security researchers and vendors participating in coordinated disclosure workflows.
Features
- Coordinated Vulnerability Disclosures - A system for privately disclosing vulnerabilities to vendors and publishing details after a fix is released or a deadline passes.
- Vulnerability Research - A public archive of security findings, proof-of-concept code, and technical reports detailing vulnerabilities in third-party software.
- Security Advisories - A structured collection of vulnerability reports used to inform the public and coordinate patches with vendors.
- Proof-of-Concept Advisories - Publish detailed security notices with proof-of-concept code for vulnerabilities found in third-party software.
- Structured Advisory Portals - Organises vulnerability reports with metadata fields for severity, affected versions, and patch status.
- Security Research Repositories - Maintaining a public archive of vulnerability findings, technical reports, and exploit data for threat intelligence and software bug pattern analysis.
- Bug Class Detection Tools - Using modular scripts and binaries to automate the detection of specific classes of software vulnerabilities across platforms.
- Exploit Proof-of-Concept Indexes - Stores executable exploit code alongside advisory documents for reproducible vulnerability verification.
- Cross-Platform Fuzzers - Applying fuzzing techniques across multiple operating systems to discover software bugs and security weaknesses.
- Cross-Platform - Runs fuzz tests across multiple operating systems and architectures to uncover software defects.
- Third Party Dependency Risk Assessment - Assessing and documenting vulnerabilities in third-party software to help organizations manage supply chain security risks.
- Threat Intelligence Aggregation - Aggregates bug pattern data and exploit characteristics for longitudinal security trend analysis.
- Bug Pattern Archives - Collecting data on software bug patterns and exploit characteristics for longitudinal security trend analysis.
- Exploit Research - Repository for security research and vulnerability analysis.
- System Programming Foundations - Collection of security research and educational materials.
- Exploit Proofs and PoCs - Security advisories and proof-of-concepts for non-Google code.
- Kernel Vulnerability Research - Repository for vulnerability reports and security research findings.
- Protection Bypasses - Security research findings and bypass techniques for kernel protections.
