CVE-2026-2796-escape-wasm-by-using-wasm

CVE-2026-2796 — SpiderMonkey WebAssembly サンドボックスエスケープ CVE-2026-2796 の概念実証エクスプロイトチェーン。Mozilla SpiderMonkey の WebAssembly インポート最適化（"JavaScript: WebAssembly" コンポーネント）における JIT 誤コンパイル / 型混乱です。細工された wasm モジュールにより、ホストプロセス全体に対する任意読み書き と任意のネイティブコード実行 が可能となり、WebAssembly サンドボックスから脱出します。 CVE: CVE-2026-2796...

CVE-2019-17026-Exploit

CVE-2019-17026 - Un bug de JIT de Firefox Bug original detectado en estado salvaje por Qihoo 360. Exploit escrito por maxpl0it. Funciona en Firefox 72.0.1 Este es un exploit para CVE-2190-17026: Confusión de tipos de IonMonkey con StoreElementHole y FallibleStoreElement Este exploit no usa un...

CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-box

CVE-2026-2796 + CVE-2026-2768 — Escape the Wasm Box Firefox のフルチェーン悪用研究: レンダラープロセスでのコード実行 のための WebAssembly 型混乱 type confusion を、サンドボックスエスケープ のための親プロセスバグへ連鎖させる。いずれのバグも Firefox 148 MFSA-2026-13 で修正済み。ここでのターゲットは、両方の修正に先行する Firefox 148-nightly ツリー @ 2fbc0748c4 2026-01-14。 CVE-2026-2796 Bug 2013165:...

jitsploitation

jitsploitation 古いJITバグであるCVE-2020-9802のiOSブラウザエクスプロイト。 これは、Project Zeroによって元々文書化された、macOSおよびiOS向けWebKitエンジンにおける人気のJITコンパイラバグのエクスプロイトです。私はブラウザエクスプロイトの学習演習として、このバグのエクスプロイトを再実装しました。 動画解説: 1クリックであなたのiPhoneをハックする方法 クレジット ProjectZero blog JakeBlair420の実装...

sfuzz

SFUZZ 開始日: 2021年12月 これは、カスタム Just-In-Time コンパイラを利用してネイティブに近いパフォーマンスを実現する、カバレッジ誘導型・エミュレーションベースのグレーボックスファザーです。RISC-V ELF バイナリを中間表現にリフティングし、実行中に JIT コンパイルして x86 へ変換することで動作します。JIT コンパイル中にコードが計測され、カバレッジ追跡、asan、cmpcov、スナップショットベースのファジングなどのファジング改善機能が有効になります。 特徴 マルチスレッド対応。任意の数のスレッドをサポートし、ほぼ線形にスケーリングします。...

CVE-2026-2766-but-with-wasm

CVE-2026-2766, but with wasm Status: validated crash PoC with demonstrated control-flow hijack crashpc = freed-cell poison 0xcdcdcdcdcdcdcdcd under the debug shell — the engine jumps to a pointer read out of the freed ICScript. Remaining work: control the reclaimed bytes. See research/README.md. ...

CVE-2024-29943-but-with-wasm

CVE-2024-29943, but with wasm An end-to-end exploit chain for CVE-2024-29943 that achieves arbitrary native code execution by smuggling shellcode into SpiderMonkey's WebAssembly JIT code page as f64.const immediates — no ROP, no VirtualProtect, no external toolchain. Verified working against the...

MiracleLinux 9 : firefox-140.13.0-1.el9_8.ML.1 (AXSA:2026-1698:20)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1698:20 advisory. libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode CVE-2026-56208 firefox: thunderbird: Site isolation issue i...

CVE-2024-29943

CVE-2024-29943 Un bug JIT di SpiderMonkey a Pwn2Own: dall'incoerenza dell'intervallo intero all'eliminazione del controllo dei limiti fino alla RCE. Riproduzione di CVE-2024-29943 per Windows, basata su https://github.com/bjrjk/CVE-2024-29943 Modifiche L'exploit originale è scritto per Linux,...

The vulnerability of the bpf_int_jit_compile() function in the arch/arm64/net/bpf_jit_comp.c module, which is part of the network support functionality on the ARM 64-bit kernel of the Linux operating system, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the bpfintjitcompile function in the arch/arm64/net/bpfjitcomp.c module, which is part of the networking support on the ARM 64-bit kernel of the Linux operating system, is related to errors during pointer scaling. Exploiting this vulnerability could allow an attacker to...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

Astra Linux – Vulnerability in Firefox

A transient execution vulnerability, named Floating Point Value Injection FPVI, allowed attackers to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. A related vulnerability, Speculative Code Store Bypass SCSB, did not affect Firefox. This vulnerability affect...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Fixed a potential memory leak related to jitdata. Make sure that jitdata is freed through kfree in the error path...

Astra Linux – Vulnerability in Firefox and Thunderbird

The WebAssembly JIT might miscalculate the size of a return type, which could lead to a null read and result in a crash. Note: This issue only affected x86-32 platforms. Other platforms are unaffected.. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

MiracleLinux 9 : thunderbird-140.13.0-1.el9_8.ML.1 (AXSA:2026-1625:19)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1625:19 advisory. firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript:...

The vulnerability of the JIT component in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, allows a hacker to induce a service failure.

The vulnerability of the JIT component in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the JIT component in Firefox ESR web browsers, Firefox browsers, and the Thunderbird email client allows a hacker to induce a service failure.

The vulnerability of the JIT component in Firefox ESR web browsers, Firefox browsers, and the Thunderbird email client is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause service interruptions...

SUSE CVE-2026-74976

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...