Currently, I am a student in the Web Security Lab
(WebSec Lab) at
UNIST (Ulsan National Institute
of Science and Technology). My primary interest lies in the discovery and analysis of
security vulnerabilities in web and browser systems through AI techniques.
Discovered by our USENIX Security 2026 paper, BUIzz: Finding Policy Enforcement Bugs via Interaction Simulation on the Browser User Interface.
In Brave Browser Desktop prior to 1.83.10 with the split view feature
enabled, the “Open Link in Split View” context menu item did not respect the
SameSite cookie attribute, so SameSite=Strict cookies
were sent on a cross-site navigation triggered through this user
interface path.
CVE-2025-32792—Endo (Secure ECMAScript)—Lexical scope exposure in SES sandbox
Discovered via Strategy 5 of our IEEE EuroS&P 2026 paper, SandVenture: Escaping JavaScript Sandboxes with Objective-driven Input Generation.
Web pages and extensions using ses and the Compartment API to evaluate
third-party code in an isolated environment inadvertently expose
const, let, and class bindings
declared in the top-level scope of a <script> tag to the
lexical scope of untrusted third-party code.