Tavis Ormandy

Tavis Ormandy is a British computer security researcher best known for roughly two decades of vulnerability research, much of it conducted at Google, including as a founding member of Google Project Zero, the company's team dedicated to finding and coordinating disclosure of zero-day vulnerabilities across the software industry. Earlier in his career he was active in the Gentoo Linux community as a security auditor before moving into a full-time security engineering role at Google.

The 2010 Windows Help and Support Center Controversy

In June 2010, Ormandy reported a critical remote-code-execution flaw in the Windows Help and Support Center's "HCP" URL handler to Microsoft. Five days later, on June 10, 2010, he published full technical details and a working exploit on the Full Disclosure mailing list, arguing that the bug was likely already known to attackers. The early public release, before Microsoft had a patch ready, drew criticism from Microsoft and other researchers who favored longer coordinated-disclosure windows, and the episode became one of the most frequently cited flashpoints in the industry's disclosure debate. Microsoft subsequently confirmed active in-the-wild exploitation and shipped an out-of-band critical bulletin, MS10-042, on July 13, 2010.

Sophail and Antivirus Research

In work published in 2011 and expanded in 2012 under the title "Sophail," Ormandy detailed multiple exploitable vulnerabilities and design flaws in Sophos's antivirus engine, arguing that antivirus and endpoint-security software, despite running with high system privileges, was not being held to the same security scrutiny as other software.

Google Project Zero and Later Work

When Google publicly announced Project Zero on July 15, 2014, Ormandy was among its founding researchers. In the years that followed he continued to find and disclose high-impact bugs: severe FireEye network-appliance vulnerabilities disclosed with colleague Natalie Silvanovich in December 2015, and, in February 2017, "Cloudbleed," a Cloudflare reverse-proxy memory-disclosure bug that had been leaking private user data across large numbers of unrelated websites. In 2023 he discovered "Zenbleed," a data-leak vulnerability in AMD's Zen 2 processor microarchitecture.

Ormandy left Google in October 2025. His body of work is frequently cited in discussions of vulnerability disclosure norms: the 2010 Windows Help Center episode remains a reference point in arguments over how much time researchers owe vendors before going public.

Timeline

• 2010-06-10Publishes full exploit details on the Full Disclosure mailing list five days after notifying Microsoft, sparking a public dispute over disclosure timelines.
• 2010-07-13Microsoft ships out-of-band security bulletin MS10-042 (CVE-2010-1885).
• 2011Publishes 'Sophail,' a critical analysis of vulnerabilities in Sophos antivirus software.
• 2014-07-15Google publicly announces Project Zero; Ormandy is among its founding researchers.
• 2017-02-17Discovers and reports 'Cloudbleed,' a Cloudflare memory-disclosure bug.
• 2023-05-15Reports 'Zenbleed' (CVE-2023-20593), a data-leak vulnerability in AMD Zen 2 processors.
• 2025-10-10Leaves Google.