Natalie Silvanovich
More info
- Affiliation
- Google, Project Zero
- Known for
- Zero-click bugs in messaging and video-calling apps
The researcher who mapped what messaging apps do with incoming data before you've even noticed it arrived.
Before Project Zero, Silvanovich worked at BlackBerry, and in her spare time became known for reverse-engineering the Tamagotchi's firmware. At Google she has specialised in the attack surface that needs no click at all: everything an app parses on its own when a message or call comes in.
In 2019 she and Samuel Groß found a run of iMessage vulnerabilities triggerable by a single message. In 2021 she showed that several video-calling apps, including Signal, Google Duo and Facebook Messenger, had logic bugs that let a caller switch on the callee's microphone or camera before the call was answered. No memory corruption required — just a state machine that trusted the wrong party.