Safe Exam Browser security research

For TU Eindhoven's offensive-security course, my team found several ways around Safe Exam Browser's Windows protections and disclosed them to its maintainers. The fixes landed in version 3.6.0, which credits our team by name.

Safe Exam Browser restricts what students can access during an online exam. We reverse-engineered the Windows client and tested DLL injection, bypassing virtual-machine detection, and evading its process monitoring to run disallowed software.

The maintainers thanked our team for "proactive, constructive and responsible vulnerability disclosure."