CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable . Befor...

CVE-2025-43541

CVE-2025-43541 WARNING: POTENTIALLY UNSAFE CODE This repository contains a JavaScript / HTML Proof of Concept PoC related to a potential WebKit / JavaScriptCore vulnerability identified as CVE-2025-43541. Disclaimer This code may be unsafe. Running this HTML file can crash the browser, especially...

CVE-2024-23222-Coruna-Exploit-Kit-Deobfuscated

🏴‍☠️ Coruna iOS Exploit Kit: Investigación de CVE-2024-23222 📌 Resumen Este repositorio contiene un análisis técnico completo y una investigación de desofuscación del Coruna iOS Exploit Kit. La investigación se centra en documentar cómo la cadena de explotación apunta a CVE-2024-23222 — una...

CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-

CVE-2025-24201 WebKit Vulnerability Detector PoC This proof-of-concept detects whether a WebKit-based browser is vulnerable to CVE‑2025‑24201 , a high-severity out-of-bounds write vulnerability caused by incorrect capability validation in the WebGL implementation. 🔍 Vulnerability Summary...

CVE-2025-43529

CVE-2025-43529 TL; DR Apple recently shipped iOS 26.2 and iPadOS 26.2, along with a security advisory that includes fixes for WebKit vulnerabilities. One bug in the DFG JIT compiler CVE-2025-43529 stood out, so I decided to dig into it. The JIT compiler correctly recognized that a Phi node where...

CVE-2018-4416-exploit

Prefacio :PROPERTIES: :CUSTOMID: preface :END: De acuerdo, la seguridad binaria no solo se trata de /heap/ y /stack/, todavía tenemos mucho por descubrir más allá de los desafíos CTF habituales. El navegador, la máquina virtual y el kernel juegan un papel importante en la seguridad binaria. Y...

WebKit-UAF-ANGLE-OOB-Analysis

WebKit-UAF-ANGLE-OOB-Analysis CVE-2025-43529, CVE-2025-14174 iOS 26.1에서의 WebKit/ANGLE 체인에 대한 메모와 PoC 자료입니다. 완전한 익스플로잇이 아니며, 검증된 프리미티브와 아직 실패하는 부분을 분리하여 정리했습니다. 작성자: zeroxjf 기반: jir4vv1t의 CVE-2025-43529 익스플로잇 상태: 부분 체인; 임의 R/W 미검증 테스트 기기: iPhone 11 Pro Max, iOS 26.1 최종 업데이트: 2026년 1월 범위 및 크레딧...

WebKit-CVE-2016-4622

WebKit CVE-2016-4622 Analysis: Deep Dive into the Slice ValueOf Fastpath Vulnerability Comprehensive analysis and exploitation of the WebKit JavaScript Core vulnerability that enables memory disclosure through Array.slice manipulation Table of Contents Executive Summary Vulnerability Overview...

CVE-2022-22629

CVE-2022-22629 Proof of concept This post is about the poc for the WebGL bug that was patched in Safari 15.4 security updates. If you want to learn in detail about how WebGL works, you can use this official resource since we are going to discuss bug specific details here :...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — 교차 포트 가로채기를 통한 동일 출처 정책 우회 CVE-2026-20643...

playwright

🎭 Playwright 문서 | API 참조 Playwright는 웹 자동화 및 테스트를 위한 프레임워크입니다. 단일 API로 Chromium, Firefox, WebKit을 구동합니다 — 테스트, 스크립트, 그리고 AI 에이전트를 위한 도구로 사용할 수 있습니다. 시작하기 워크플로우에 맞는 경로를 선택하세요: Playwright Test Playwright Test는 엔드투엔드 테스트를 위해 설계된 완전한 기능을 갖춘 테스트 러너입니다. Chromium, Firefox, WebKit에서 완전한 브라우저 격리, 자동 대기, 웹...

CVE-2019-8601

Explotando CVE-2019-8601 Este es un exploit para una vulnerabilidad de WebKit que fue descubierta originalmente por Fluoroacetate durante la competencia pwn2own en Vancouver. Aunque no descubrí este error, escribí este exploit para practicar mis habilidades de desarrollo de exploits. El artículo...

Bad_Hoist-WriteUp

Версия Sleirsgoevy для BadHoist Write-up | CVE-2018-4386 !Note Справочная информация о PS4: Консоль PlayStation 4 оснащена пользовательским AMD x86-64 CPU 8 ядер, ее ОС Orbis основана на FreeBSD v9.0 с частями из NetBSD. Она также включает широкий спектр дополнительного открытого ПО, такого как...

CVE-2026-43735

CVE-2026-43735 WebKit cross-origin information leak. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Principle When the parent page uses to trigger a fragment navigation of a cross-origin iframe, the NavigateEvent.sourceElement received by the iframe is the element of the parent page...

CVE-2026-47423-dompurify-xss-detector

DOMPurify re-clone logic flaw. Instead of relying on easily stripped source comments or version variables, this tool performs logic fingerprinting on minified production JavaScript bundles to identify unpatched allowed-tag layouts. Vulnerability Summary In DOMPurify versions up to 3.4.4, the...

CVE-2020-17057

I wrote this exp based on this blog（https://blogs.360.cn/post/CVE-2020-17057%20detail%20and%20exploit.html），But I ended up with only palette objects with dangling data pointer. Because of type isolation, I can't get arbitrary R/W primitives by using palettes or bitmap objects，If you have a way to...

PS5-UMTX-Jailbreak

PSFree version 1.4.0 PSFree is a WebKit exploit using CVE-2022-22620 to gain arbitrary read/write. vulnerable: PS4 6.xx-9.xx tested 6.00-9.60 PS5 1.xx-5.xx tested 1.00-5.50 CREDITS: anonymous for PS4 firmware kernel dumps janisslsm from ps4-dev on discord.com contributed ROP chain managers for 8....

totally-not-spyware

TotallyNotSpyware This program is definitely not spyware. Run it on your 64-bit iOS device as soon as possible. Your compliance will be rewarded. Live version at totally-not.spyware.lol Repo structure & building Frontend and WebKit exploit are in /root. Kernel exploit is in /glue. Post-exploitati...

CTT-Apple-Silicon-Refraction

CTT-Apple-Silicon-Refraction webkitrefraction.js The 33-Layer WebGL Payload ​This JavaScript payload uses the \alpha constant to create a high-frequency "Memory Shiver." It induces the Use-After-Free UAF in CVE-2025-43529 by desynchronizing the WebKit garbage collector from the GPU's Metal comman...

pwn2own2018

Pwn2Own 2018: Safari + macOS Safari RCE, sandbox escape, and LPE to kernel for macOS 10.13.3. Usage Install nasm and tornado: root@kitploit: brew install nasm pip3 install tornado Check config.py if you want to change the host or ports. Afterwards start the server with ./server.py and navigate to...