CVE-2018-4416-exploit

Preface :PROPERTIES: :CUSTOMID: preface :END: OKay, binary security is not only /heap/ and /stack/, we still have a lot to discover despite regular CTF challenge. Browser, Virtual Machine, and Kernel all play an important role in binary security. And I decide to study browser first. I choose a...

DarkSword_analysis

DarkSwordanalysis Static analysis of the DarkSword iOS WebKit exploit chain — delivery, staging, and CVE breakdown CVE-2025-31277, CVE-2025-43529 I'm a freshman Information Systems student working through this exploit chain as I build my reverse engineering and malware analysis skills. I'll updat...

pwn2own2020

Compromising the macOS Kernel through Safari by Chaining Six Vulnerabilities Overview This repository contains exploitation and technical details of our Pwn2Own 2020 winning submission targeting Apple Safari with a kernel escalation of privilege for macOS 10.15.3. For further information, you can...

CVE-2022-22629

CVE-2022-22629 Proof of concept This post is about the poc for the WebGL bug that was patched in Safari 15.4 security updates. If you want to learn in detail about how WebGL works, you can use this official resource since we are going to discuss bug specific details here :...

CVE-2025-43529

CVE-2025-43529 TL; DR Apple recently shipped iOS 26.2 and iPadOS 26.2, along with a security advisory that includes fixes for WebKit vulnerabilities. One bug in the DFG JIT compiler CVE-2025-43529 stood out, so I decided to dig into it. The JIT compiler correctly recognized that a Phi node where...

WebKit-UAF-ANGLE-OOB-Analysis

WebKit-UAF-ANGLE-OOB-Analysis CVE-2025-43529, CVE-2025-14174 Notas y material de PoC para una cadena WebKit/ANGLE en iOS 26.1. Esto no es un exploit completo; separa las primitivas verificadas de las piezas que aún fallan. Autor: zeroxjf Basado en: exploit de jir4vv1t para CVE-2025-43529 Estado:...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable . Befor...

CVE-2025-43541

CVE-2025-43541 WARNING: POTENTIALLY UNSAFE CODE This repository contains a JavaScript / HTML Proof of Concept PoC related to a potential WebKit / JavaScriptCore vulnerability identified as CVE-2025-43541. Disclaimer This code may be unsafe. Running this HTML file can crash the browser, especially...

CVE-2024-23222-Coruna-Exploit-Kit-Deobfuscated

🏴‍☠️ Coruna iOS Exploit Kit: CVE-2024-23222 Research 📌 Overview This repository contains a comprehensive technical analysis and deobfuscation research of the Coruna iOS Exploit Kit. The research focuses on documenting how the exploit chain targets CVE-2024-23222 — a high-severity type confusion...

CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-

CVE-2025-24201 WebKit Vulnerability Detector PoC This proof-of-concept detects whether a WebKit-based browser is vulnerable to CVE‑2025‑24201 , a high-severity out-of-bounds write vulnerability caused by incorrect capability validation in the WebGL implementation. 🔍 Vulnerability Summary...

Bad_Hoist-WriteUp

Sleirsgoevy's version of BadHoist Write-up | CVE-2018-4386 !Note Background information about the PS4: The PlayStation 4 Console features a custom AMD x86-64 CPU 8 cores, it's Orbis OS is based on FreeBSD v9.0 with parts of NetBSD as well. It also includes a wide variety of additional open source...

WebKit-CVE-2016-4622

WebKit CVE-2016-4622 Analysis: Deep Dive into the Slice ValueOf Fastpath Vulnerability Comprehensive analysis and exploitation of the WebKit JavaScript Core vulnerability that enables memory disclosure through Array.slice manipulation Table of Contents Executive Summary Vulnerability Overview...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — 교차 포트 가로채기를 통한 동일 출처 정책 우회 CVE-2026-20643...

playwright

🎭 Playwright 문서 | API 참조 Playwright는 웹 자동화 및 테스트를 위한 프레임워크입니다. 단일 API로 Chromium, Firefox, WebKit을 구동합니다 — 테스트, 스크립트, 그리고 AI 에이전트를 위한 도구로 사용할 수 있습니다. 시작하기 워크플로우에 맞는 경로를 선택하세요: Playwright Test Playwright Test는 엔드투엔드 테스트를 위해 설계된 완전한 기능을 갖춘 테스트 러너입니다. Chromium, Firefox, WebKit에서 완전한 브라우저 격리, 자동 대기, 웹...

CVE-2019-8601

Exploiting CVE-2019-8601 This is an exploit for a WebKit vulnerability that was originally discovered by Fluoroacetate during the pwn2own competition in Vancouver. While I did not discover this bug, I wrote this exploit to practice my exploit development skills. The original writeup for this...

CVE-2026-43735

CVE-2026-43735 WebKit cross-origin information leak. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Principle When the parent page uses to trigger a fragment navigation of a cross-origin iframe, the NavigateEvent.sourceElement received by the iframe is the element of the parent page...

CVE-2026-47423-dompurify-xss-detector

DOMPurify re-clone logic flaw. Instead of relying on easily stripped source comments or version variables, this tool performs logic fingerprinting on minified production JavaScript bundles to identify unpatched allowed-tag layouts. Vulnerability Summary In DOMPurify versions up to 3.4.4, the...

CVE-2020-17057

I wrote this exp based on this blog（https://blogs.360.cn/post/CVE-2020-17057%20detail%20and%20exploit.html），But I ended up with only palette objects with dangling data pointer. Because of type isolation, I can't get arbitrary R/W primitives by using palettes or bitmap objects，If you have a way to...

PS5-UMTX-Jailbreak

PSFree version 1.4.0 PSFree is a WebKit exploit using CVE-2022-22620 to gain arbitrary read/write. vulnerable: PS4 6.xx-9.xx tested 6.00-9.60 PS5 1.xx-5.xx tested 1.00-5.50 CREDITS: anonymous for PS4 firmware kernel dumps janisslsm from ps4-dev on discord.com contributed ROP chain managers for 8....

totally-not-spyware

TotallyNotSpyware This program is definitely not spyware. Run it on your 64-bit iOS device as soon as possible. Your compliance will be rewarded. Live version at totally-not.spyware.lol Repo structure & building Frontend and WebKit exploit are in /root. Kernel exploit is in /glue. Post-exploitati...