576 matches found
CVE-2024-8381
CVE-2024-8381 Un error de confusión de tipos en el intérprete SpiderMonkey. Este repositorio contiene análisis en formato Markdown y diapositivas, incluyendo la causa raíz, el PoC y el exploit. Desafortunadamente, debido a la naturaleza de este error, el exploit solo es aplicable cuando ASLR está...
CVE-2026-8389
CVE-2026-8389 This vulnerability was intended to be used at Pwn2Own 2026 Berlin, but was patched in version 150.0.3. SpiderMonkey BaselineJIT pcOffset bitfield truncation on the eager off-thread baseline-compile path, leading to a wrong-but-in-bounds bytecode pc during exception unwinding and a...
cve-2019-11707
SpiderMonkey - CVE-2019-11707 Bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=1820 Capturas de pantalla Archivos exploit.js - Exploit real, precedido por los util.js y Int64.js de saelo. stager.js - Se utiliza para crear constantes, precedido por los util.js y Int64.js de saelo...
CVE-2024-29943
CVE-2024-29943 Un bug de JIT de SpiderMonkey de Pwn2Own: Desde inconsistencia en el rango de enteros hasta eliminación de comprobación de límites y luego RCE. Este repositorio contiene PoC, Exploit y Diapositivas de Análisis para CVE-2024-29943. Demo Demo.mp4 Diapositivas Slides.pdf Información...
New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses
A group of academics from VUSec and Scuola Superiore Sant'Anna have disclosed details of a new Spectre CPU vulnerability variant that affects Just-In-Time JIT engines present in web browsers, language runtimes, and the operating system kernel, across multiple CPU vendors. The new Spectre v2 varia...
CVE-2026-2796-escape-wasm-by-using-wasm
CVE-2026-2796 — SpiderMonkey WebAssembly Sandbox Escape Proof-of-concept exploit chain for CVE-2026-2796 , a JIT miscompilation / type-confusion in Mozilla SpiderMonkey's WebAssembly import optimization "JavaScript: WebAssembly" component. A crafted wasm module obtains arbitrary read/write of the...
CVE-2026-15718-who-put-ptrs-in-my-wasm
CVE-2026-15718 — who put ptrs in my wasm Proof-of-concept exploit chain for CVE-2026-15718 , a missing-sync miscompilation in Mozilla SpiderMonkey's WebAssembly baseline compiler "JavaScript: WebAssembly" component. A single zero-trip array.fill yields a fakeobj primitive; the chain escalates to...
CVE-2024-29943
CVE-2024-29943 A Pwn2Own SpiderMonkey JIT Bug: From Integer Range Inconsistency to Bound Check Elimination then RCE. Reproducing CVE-2024-29943 for Windows, based on https://github.com/bjrjk/CVE-2024-29943 Modifications The original exploit is written for Linux, so I attempted to reproduce it on...
CVE-2024-29943-but-with-wasm
CVE-2024-29943, but with wasm An end-to-end exploit chain for CVE-2024-29943 that achieves arbitrary native code execution by smuggling shellcode into SpiderMonkey's WebAssembly JIT code page as f64.const immediates — no ROP, no VirtualProtect, no external toolchain. Verified working against the...
CVE-2026-84118-who-labeled-the-crit-as-a-high
CVE-2026-84118 — SpiderMonkey GC use-after-free Bug 2057457 This is one of those where Mozilla labeled a Critical as a High. So someone might want to go have Firefox update the original bug hunters payment if that's the case. THE TLDR: You can do an OOB R primitive on a controlled pointer and the...
CVE-2026-2763-POC
Vulnerability The vulnerability arises from the implementation of the for-in syntax. The scope of a for-in loop is represented by a pair of bytecodes: JSOP::Iter and JSOP::EndIter. CASEIter MOZASSERTREGS.stackDepth = 1; HandleValue val = REGS.stackHandleAt-1; JSObject iter = ValueToIteratorcx, va...
Exploit for Use After Free in Mozilla Firefox
CVE-2026-84118 — SpiderMonkey GC use-after-free Bug 2057457...
Exploit for Protection Mechanism Failure in Mozilla Firefox
CVE-2026-2796 + CVE-2026-2768 — Escape the Wasm Box Full-chai...
Exploit for Type Confusion in Mozilla Firefox
CVE-2026-2796 — SpiderMonkey WebAssembly Sandbox Escape Proof...
OESA-2026-3213 mozjs102 security update
SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fixes: Unexpected data returned from the Safe Browsing API could have led to memory corruption and a...
MiracleLinux 8 : thunderbird-102.13.0-2.el8.ML.1 (AXSA:2023-6238:20)
The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6238:20 advisory. Mozilla: Use-after-free in WebRTC certificate generation CVE-2023-37201 Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey...
MiracleLinux 9 : thunderbird-102.8.0-2.el9.ML.1 (AXSA:2023-5140:11)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-5140:11 advisory. Mozilla: Arbitrary memory write via PKCS 12 in NSS CVE-2023-0767 Mozilla: Content security policy leak in violation reports using iframes...
MiracleLinux 9 : thunderbird-102.13.0-2.el9.ML.1 (AXSA:2023-6243:21)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6243:21 advisory. Mozilla: Use-after-free in WebRTC certificate generation CVE-2023-37201 Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey...
MiracleLinux 7 : firefox-102.13.0-2.0.1.el7.AXS7 (AXSA:2023-6240:25)
The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2023-6240:25 advisory. Mozilla: Use-after-free in WebRTC certificate generation CVE-2023-37201 Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey...
