Preliminary research

8 out of 10 Banks HATE This One Weird 3SKey RCE

James Arnott · Am I Being Pwned? · 2 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

A signature verifier ignores failed RSA conversion and compares a stale output buffer, allowing heap preparation to satisfy several independent signature gates. A long-lived browser native-message connection prepares the heap across origin, manifest and DLL signature checks; hardware-token compromise is not demonstrated.

Record

Researcher

James Arnott

Published by

Am I Being Pwned?

Date

2 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• browser-extension
• signature-verification
• uninitialized-memory
• native-messaging

This page is the archive's own catalogue record. The research is the work of James Arnott, first published at the original source. Preserved copies are kept so the citation survives its host.