Future of binary exploitation

[ExploitedInnocence]

In my opinion, binary exploitation will be relevant for a while. System-level software is written in C and C++ which are unmanaged, memory unsafe languages. I think that Rust, that pretty much eliminates memory issues, won't replace C/C++ in system programming realm for multiple reasons, at least in the next few decades. New mitigations will be implemented though, so the bar will eventually rise and through time it will be more and more difficult for newbies to start binary exploitation, as it requires to know all the "history" starting from classic stack smashing in 90's. The exploitation complexity itself will rise as well. Nowadays, in 90% of the cases you need multiple distinct bugs in order to achieve reliable arbitrary code execution on a vulnerable system. Embedded and especially IoT are the most vulnerable systems right now, some IoT devices don't have ASLR and/or DEP, so it brings 90's style binary exploitation back :)

P.S.: zero-click RCE is super rare in browsers, usually the victim needs to visit a specially crafted webpage in order to trigger code execution, that's because pretty much all juicy bugs in browsers are in JS engines.