Appendix C: Publications & Track Record
Author: Shrikant Bhosale (@debtcollector21)
C.1 Published Work
| Title | Type | Date | Link / Venue |
|---|---|---|---|
| “The DCHECK Illusion: Trusted-Path Vulnerabilities in Chrome Mojo” | Blog post | Jul 13 2026 | potatobullet.com |
| “Error Principle: Information Debt as Root Cause” | White paper | Jul 2026 | In preparation |
| “AttackGraph: Formal Exploit Chain Modeling” | White paper | Jul 2026 | In preparation |
C.2 Confirmed VRP Submissions
| ID | Target | Pattern | CVSS | Status |
|---|---|---|---|---|
| A01 | [Vendor] Parcel | Capacity/Size Confusion | 8.1 | [Vendor] P2/S2, Issue 527869444 |
| A06 | Android AMS/NMS/UGMS | Information Debt (53 instances) | 7.1 | [Vendor] P2/S2, Issue 533645392 |
| Y01-Y05 | YouTube C2PA | Hardcoded Enrollment API Key | 8.8 | [Vendor] Mobile VRP P4/S4 |
| Instagram Android | Cleartext HTTP Deep Links | 8.2 | [Vendor] submission | |
| Chime | Chime Android | Deep Link Injection | 8.0 | [Vendor] submission |
| Moovit | Moovit Android | Error Principle Methodology | — | [Vendor] submission |
| [Vendor] | 14 [Vendor] apps | DCHECK bypass | 7.5 | Responsibly disclosed |
| Free Fire | Garena/Sea | HTTP Analytics | 8.0 | Submitted, rejected duplicate |
| Amazon | Amazon Shopping | OAuth HTTP | 8.8 | Submission-ready |
| Cash App | Cash App Android | Resource Leak Chains | 8.0 | Submission-ready |
| Airtel | Airtel Payments Bank | Kong Infrastructure Exposure | 7.5 | [Vendor]-ready |
| X (Twitter) | X Android | Cleartext Money Endpoints | 8.8 | H1 Informative |
C.3 Presentations & Talks
None yet. The author’s potato rig (15GB RAM, 4 cores) limits video/streaming production. As funding improves, conference talks and video PoC demonstrations are planned.