Browser - Vulnerability Researcher

Trenchant; United States; Remote; USD 140,000 - 230,000; Full time

Job summary

Trenchant is a fully remote offensive-security organization seeking a researcher with a proven track record in discovering and exploiting browser vulnerabilities in production releases. You will own the end-to-end lifecycle from surface selection to reliable primitives and handover, reporting directly to senior researchers and exploit developers.

Focused on memory-corruption and logic bugs in Chromium internals, you will analyze patches, contribute to exploit chains, and build reproducible

Qualifications

• Proven record of delivering browser vulnerabilities or exploit components against modern browser releases.
• Deep practical knowledge of Chromium internals, renderer and V8.
• Strong C/C++ debugging, reverse engineering and source-audit skills.
• Hands-on experience turning bugs into useful primitives (use-after-free, type confusion, OOB).
• Understanding of V8 Sandbox security model and exploitation strategy.

Responsibilities

• Identify renderer-reachable attack surfaces in Chromium; may work on WebKit/Firefox where relevant.
• Develop original browser vulnerabilities with clear root cause and reproducible steps.
• Create exploit primitives or chain components that survive mitigations.
• Produce minimised test cases, exploitability analysis, and reproducible research environments.
• Deliver readable exploit code and technical docs for fellow researchers.

Skills

Vulnerability research

Exploit development

Reverse engineering

C/C++ debugging

Independent work

Tools

V8

Job description

You will join an established offensive-security organisation with a large team of senior and principal-level vulnerability researchers and exploit developers. Our browser research is focused on producing working exploit capability - not just crashes, reports or theoretical attack paths. This role is for a researcher who has already found and exploited vulnerabilities in production browsers. You should be comfortable owning the full path from attack-surface selection and root-cause analysis to reliable primitives, exploitability decisions and clean technical handover.

What you'll work on

• Renderer-reachable attack surfaces in Chromium, with room to work on WebKit or Firefox where relevant.

• Memory-corruption and logic vulnerabilities in V8, Blink, WebAssembly, DOM bindings, parsers, media, graphics and adjacent C/C++ components.

• Exploitation under modern constraints including pointer compression, heap isolation, control-flow protections and the V8 Sandbox (formerly commonly referred to as the Ubercage).

• Variant analysis, patch diffing and adjacent-code research rather than stopping after a single bug.

• Collaboration with sandbox, platform and kernel researchers when a renderer issue is part of a larger chain.

What you'll deliver

• Original browser vulnerabilities with a clear root cause and reliable reproduction.

• Working exploit primitives or chain components that survive realistic release-build mitigations.

• Minimised test cases, exploitability analysis, affected-version notes and reproducible research environments.

• Readable exploit code and technical documentation that another senior researcher can pick up and extend.

• Tooling that improves fuzzing, instrumentation, crash triage, variant hunting or exploit-development speed.

What we're looking for

• A proven record of delivering browser vulnerabilities or exploit components against modern browser releases.

• Deep practical knowledge of Chromium internals, ideally including both the renderer and V8.

• Strong C/C++ debugging, reverse engineering and source-audit skills.

• Hands-on experience turning use-after-free, type confusion, out-of-bounds access or related bug classes into useful primitives.

• A real understanding of the V8 Sandbox security model and how it changes exploitation strategy.

• The judgement to distinguish an interesting crash from a chainable, operationally meaningful vulnerability.

• The ability to work independently and finish difficult research without constant direction.

Strong signals

• Browser CVEs, Pwn2Own-level work or comparable real-world exploit delivery.

• Experience with custom browser builds, sanitizers, source instrumentation and targeted fuzzing harnesses.

• Exploit-chain work across Android, iOS, macOS, Windows or Linux.

• Research on JITs, garbage-collected heaps, cross-language ownership.

• A history of raising the technical level of other experienced researchers.

How we work

• Fully remote, with high autonomy and direct access to other senior researchers and exploit developers.

• We care about completed, reproducible technical delivery.

• Public credits are useful but not required.