Kirtikumar Anandrao Ramchandani KirtiRamchandani

Website | LinkedIn | X | Codeforces | Portfolio Source

33 assigned CVEs 11 vendors BlueHat 2024 Codeforces peak Master 2136

kirti@research-lab:~$ ./profile --mode=dossier
identity   Kirtikumar Anandrao Ramchandani / FaLcOn
focus      browser engines, kernel paths, Android WebViews, mobile trust UI
record     33 assigned CVEs across 11 vendors
stage      BlueHat 2024, CheckMates / CPX 2024, IEEE sessions
arena      Codeforces peak Master 2136, WCG 2019 APAC Top 7 / World Top 32

Signal Grid

Track	What I hunt	Proof style
Browser internals	Chrome, Firefox, WebKit, Brave, Yandex, Opera	Origin proof, UI trust break, memory-safety repro
Kernel and platform	Linux kernel, Windows/browser platform edges	Bounds proof, patch trail, reachable control path
Android trust UI	WebViews, URL bars, intents, USSD, app handoff	User-visible boundary break with reproducible PoC
Privacy leaks	Referer, Origin, PII, payment or hidden-service leakage	Network trace, server-side evidence, vendor fix
Competitive programming	Codeforces, ICPC-style contests, world championships	Fast reduction, invariants, implementation under pressure

CVE Atlas

The list below is grouped by product family, not by hype. It intentionally mixes memory corruption, SOP breaks, URL-bar trust bugs, privacy leaks, DoS issues, and platform hardening because the interesting part is the boundary being crossed.

Chrome / Chromium - 4

CVE	Surface	Boundary	Public source
CVE-2023-1818	Vulkan	Use-after-free, heap corruption via crafted HTML	Chrome 112 advisory
CVE-2023-1231	Chrome Android Autofill	Omnibox spoof via crafted HTML	Chrome 111 advisory
CVE-2021-30589	Sharing	Domain spoof through insufficient validation	Chrome 92 advisory
CVE-2021-21187	URL formatting	IDN homograph domain spoofing	Chrome 89 advisory

Mozilla Firefox / Thunderbird - 5

CVE	Surface	Boundary	Public source
CVE-2025-8041	Firefox for Android	Origin hidden by URL truncation	MFSA-2025-56
CVE-2024-5693	Offscreen Canvas	Cross-origin taint tracking failure	MFSA-2024-25
CVE-2023-25749	Firefox for Android	Third-party app opened without prompt	MFSA-2023-09
CVE-2022-22758	`tel:` links	USSD codes included in phone flow	MFSA-2022-04
CVE-2022-22736	Module loading	Local privilege escalation path	MFSA-2022-01

Apple WebKit / Safari - 2

CVE	Surface	Boundary	Public source
CVE-2022-46692	WebKit state management	Same-Origin Policy bypass	Apple advisory
CVE-2022-46695	Framed web content	Safari UI spoofing	Apple advisory

WithSecure / F-Secure SAFE - 9

CVE	Surface	Boundary	Public source
CVE-2021-44748	SAFE Browser	Universal XSS through auto-loaded images	F-Secure advisory
CVE-2021-44749	Browsing protection	Universal XSS through URL handling	F-Secure advisory
CVE-2021-44751	SAFE Browser Android	Unwanted USSD messages or calls	F-Secure advisory
CVE-2022-28868	Address bar	Next URL flash spoof	F-Secure advisory
CVE-2022-28869	Address bar	Incomplete URL display spoof	F-Secure advisory
CVE-2022-28870	Address bar	Old URL shown after failed navigation	F-Secure advisory
CVE-2022-28872	Address bar	Failed navigation loop spoof	F-Secure advisory
CVE-2022-28873	`window.open`	Address-bar spoofing attack	F-Secure advisory
CVE-2022-38163	Drag and drop	Address-bar spoof through drag operation	F-Secure advisory

Yandex Browser - 5

CVE	Surface	Boundary	Public source
CVE-2020-27969	Yandex Browser Android	SOP bypass and address-bar spoofing	Yandex Hall of Fame
CVE-2020-27970	Yandex Browser	Address-bar spoofing	Yandex Hall of Fame
CVE-2021-25254	Yandex Browser Lite Android	Address-bar spoofing	Yandex Hall of Fame
CVE-2021-25255	Yandex Browser Lite Android	Denial of service	Yandex Hall of Fame
CVE-2021-25262	Yandex Browser Android	IDN homograph attack	Yandex Hall of Fame

Microsoft Edge / Microsoft - 2

CVE	Surface	Boundary	Public source
CVE-2020-17153	Edge URL bar	Long crafted URL spoof	MSRC
CVE-2021-24100	Microsoft product flow	PII and payment information disclosure	MSRC

Linux, Brave, Opera, Oracle, Mahara - 6

CVE	Vendor	Boundary	Public source
CVE-2021-32078	Linux kernel	OOB read in `arch/arm/mach-footbridge/personal-pci.c`	Kernel fix
CVE-2022-30334	Brave	`.onion` URL leak in Referer / Origin headers	HackerOne report
CVE-2020-6158	Opera Mini Android	Address-bar spoofing	Opera advisory
CVE-2020-2545	Oracle HTTP Server	Unauthenticated compromise over HTTPS	Oracle CPU
CVE-2017-17455	Mahara	Incorrect redirect / SSL stripping risk	Mahara advisory
CVE-2019-9709	Mahara	Stored XSS in SmartEvidence collection titles	Mahara advisory

Attack-Surface Lanes

Lane	CVEs
Memory safety	CVE-2023-1818
SOP and origin model	CVE-2022-46692, CVE-2024-5693, CVE-2020-27969
Address-bar and browser UI trust	CVE-2025-8041, CVE-2023-1231, CVE-2020-17153, CVE-2020-27970, CVE-2021-25254, CVE-2020-6158, CVE-2022-28868, CVE-2022-28869, CVE-2022-28870, CVE-2022-28872, CVE-2022-28873, CVE-2022-38163
Mobile handoff	CVE-2023-25749, CVE-2022-22758, CVE-2021-44751
Privacy and information disclosure	CVE-2022-30334, CVE-2021-24100
Kernel / platform	CVE-2021-32078, CVE-2022-22736, CVE-2020-2545
Web application security	CVE-2017-17455, CVE-2019-9709

flowchart LR
    A["Weird behavior"] --> B["Minimal reproducer"]
    B --> C["Boundary proof"]
    C --> D["Vendor report"]
    D --> E["Patch / advisory"]
    E --> F["Regression memory"]
    F --> A

Talks And Rooms

Stage	Topic	Signal
Microsoft BlueHat 2024	Hacking WebViews for Fun and Profit	Intent-based and `tel:` URL-based WebView attack paths
CheckMates / CPX 2024, Bangkok	WebViews to hack applications	Browser security, WebViews, application trust boundaries
IEEE Nirma University	Browser and cybersecurity session	Student/community security education
IEEE GCET	Cybersecurity session	Responsible disclosure, browser bugs, practical attack surfaces

Championship Ledger

International IT, Engineering And Programming

Year	Event	Result
2025	The Professionals	Individual Silver, Team Bronze
2025	BRICS Hi-Tech, Yekaterinburg	Silver, 9th consecutive international podium
2024	BRICS Future Skills, Kazan	1st, Drone AI and Electrical Engineering
2024	Games of the Future, Kazan	Sports Programming Finalist
2023	The Professional Championship, St. Petersburg	Bronze, IT Software Solutions for Business
2023	International High Technologies Championship, Veliky Novgorod	Silver, Neural Networks and Big Data

Esports, Olympiads And Recognition

Track	Result
World Cyber Games 2019	India representative, APAC Top 7, World Top 32
World Cyber Games 2019 National Clash Royale	National Champion
Paytm First Games Clash Royale	National Champion
Clash Royale League 2019	20 wins, world's No. 1 weekly Grand Challenge finisher
VIVO PUBGM Tournament	Champion in 1v1, 2v2, and 2v4 formats
Penetration Tester of the Year	Cyber Security Awards 2018
Online World Records	Youngest cyber security researcher and ethical hacker
Book of Achievers	Profiled as a young cybersecurity researcher
Olympiads and diplomacy	IMO / NSO Top 100, NCO Top 400, 29 MUNs, 2 Youth Parliaments

Visual trophy reel

Codeforces And GitHub

Codeforces
Handle: secresearch1979
Current rank: expert, rating 1898
Peak rank: master, max rating 2136
Notable sprint: Div. 2 rank 129 in Codeforces Round 983

GitHub
Public repos: 77
Profile started: 2017
Current map: browser engines, developer tooling, security research, portfolio work
Favorite repos: CPForge, portfolio, BrowserVulnerabilities

Stack And Field Kit

languages   C | C++ | JavaScript | TypeScript | Python | Shell | PowerShell | Java | Kotlin | Rust
platforms   Chromium | Gecko | WebKit | Android | Linux | Windows | browser WebViews
workflow    reduce crash -> prove boundary -> write report -> verify patch -> remember regression

Public Footprints

Type	Link
Brave `.onion` leak	HackerOne report
Brave write-up topic	Uncovering TOR's hidden gems: .onion URLs
Yandex Browser recognition	Yandex Browser Hall of Fame
Personal portfolio	kirtikumarar.com
Portfolio source	KirtiRamchandani/portfolio
Speaker profile	Sessionize

Operating Notes

I like bugs where the trust boundary is visible:
URL bars that lie, origins that bleed, canvases that forget taint,
mobile intents that jump too far, kernels that trust an index,
and privacy modes that leak one header too many.

FaLcOn
Clean proof first. Loud claims later.

Navigation Menu