589 matches found
CVE-2024-29943
CVE-2024-29943 A Pwn2Own SpiderMonkey JIT Bug: From Integer Range Inconsistency to Bound Check Elimination then RCE. Reproducing CVE-2024-29943 for Windows, based on https://github.com/bjrjk/CVE-2024-29943 Modifications The original exploit is written for Linux, so I attempted to reproduce it on...
jscpwn
CVE-2016-4622 PoC exploit for CVE-2016-4622. Find a detailed writeup of the bug on phrack...
CVE-2024-29943
CVE-2024-29943 A Pwn2Own SpiderMonkey JIT Bug: From Integer Range Inconsistency to Bound Check Elimination then RCE. This repository contains PoC, Exploit and Analysis Slides for CVE-2024-29943. Demo Demo.mp4 Slides Slides.pdf Reproduce Information Github Git Commit:...
CVE-2026-2763-POC
Vulnerability The vulnerability arises from the implementation of the for-in syntax. The scope of a for-in loop is represented by a pair of bytecodes: JSOP::Iter and JSOP::EndIter. CASEIter MOZASSERTREGS.stackDepth = 1; HandleValue val = REGS.stackHandleAt-1; JSObject iter = ValueToIteratorcx, va...
CVE-2026-2796-escape-wasm-by-using-wasm
CVE-2026-2796 — SpiderMonkey WebAssembly Sandbox Escape Proof-of-concept exploit chain for CVE-2026-2796 , a JIT miscompilation / type-confusion in Mozilla SpiderMonkey's WebAssembly import optimization "JavaScript: WebAssembly" component. A crafted wasm module obtains arbitrary read/write of the...
CVE-2026-15718-who-put-ptrs-in-my-wasm
CVE-2026-15718 — who put ptrs in my wasm Proof-of-concept exploit chain for CVE-2026-15718 , a missing-sync miscompilation in Mozilla SpiderMonkey's WebAssembly baseline compiler "JavaScript: WebAssembly" component. A single zero-trip array.fill yields a fakeobj primitive; the chain escalates to...
btr
Branch Target Reuse BTR Artifacts This repository contains the artifacts for the paper "Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries" accepted at ACM CCS 2026. For more information about the BTR attack, see our project-page and our paper! bt...
CVE-2026-8389
CVE-2026-8389 This vulnerability was intended to be used at Pwn2Own 2026 Berlin, but was patched in version 150.0.3. SpiderMonkey BaselineJIT pcOffset bitfield truncation on the eager off-thread baseline-compile path, leading to a wrong-but-in-bounds bytecode pc during exception unwinding and a...
CVE-2024-8381
CVE-2024-8381 A SpiderMonkey Interpreter Type Confusion Bug. This repository contains analyses in markdown and slide forms, including root cause, PoC, and exploit. Unfortunately, due to nature of this bug, exploit is only applicable when ASLR is disabled. Slides: Slides.pdf Analysis: Analysis.md...
CVE-2024-29943-but-with-wasm
CVE-2024-29943, but with wasm An end-to-end exploit chain for CVE-2024-29943 that achieves arbitrary native code execution by smuggling shellcode into SpiderMonkey's WebAssembly JIT code page as f64.const immediates — no ROP, no VirtualProtect, no external toolchain. Verified working against the...
CVE-2026-84118-who-labeled-the-crit-as-a-high
CVE-2026-84118 — SpiderMonkey GC use-after-free Bug 2057457 This is one of those where Mozilla labeled a Critical as a High. So someone might want to go have Firefox update the original bug hunters payment if that's the case. THE TLDR: You can do an OOB R primitive on a controlled pointer and the...
Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2023_0810)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230810 advisory. Mozilla: Arbitrary memory write via PKCS 12 in NSS CVE-2023-0767 Mozilla: Content security policy leak in violation reports using iframes CVE-2023-25728...
Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2023_4063)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234063 advisory. Mozilla: Use-after-free in WebRTC certificate generation CVE-2023-37201 Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey...
Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2023_4952)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234952 advisory. Mozilla: Memory corruption in IPC CanvasTranslator CVE-2023-4573 Mozilla: Memory corruption in IPC ColorPickerShownCallback CVE-2023-4574 Mozilla: Memory...
Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2023_4954)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234954 advisory. Mozilla: Memory corruption in IPC CanvasTranslator CVE-2023-4573 Mozilla: Memory corruption in IPC ColorPickerShownCallback CVE-2023-4574 Mozilla: Memory...
[SECURITY] Fedora 45 Update: gjs-1.90.0-1.fc45
Gjs allows using GNOME libraries from Javascript. It's based on the Spidermonkey Javascript engine from Mozilla and the GObject introspection framework...
New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses
A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time JIT engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors. The new Spectre v2 varia...
Exploit for Use After Free in Mozilla Firefox
CVE-2026-84118 — SpiderMonkey GC use-after-free Bug 2057457...