POC-CVE-2025-6554

CVE-2025-6554 CVE-2025-6554 is a vulnerability in Chrome's V8 Engine JavaScript interpreter Hole Check 'inadequate control in unintended variables within expressions with optional chaining. POC CVE-2025-6554-POC.JS explores a flaw in the "Hole" verification mechanism in variables before use,...

CVE-2021-34371.jar

CVE-2021-34371.jar CVE-2021-34371.jar from https://github.com/vulhub/vulhub/tree/master/neo4j/CVE-2021-34371/rhinogadget USE EXP...

CVE-2026-91728

A flaw was found in V8, the JavaScript engine used in Google Chrome. An integer overflow vulnerability allows a remote attacker to execute arbitrary code within the browser's security sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page...

BadKernel

BadKernel full exploit for CVE-2016-6754BadKernel slide for syscan2016 shanghai "BadKernel --- exploit V8 with a typo"...

jscpwn

CVE-2016-4622 PoC exploit for CVE-2016-4622. Find a detailed writeup of the bug on phrack...

external_v8_AOSP10_r33_CVE-2021-0393

V8 JavaScript Engine V8 is Google's open source JavaScript engine. V8 implements ECMAScript as specified in ECMA-262. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 can run standalone, or can be embedded into any C++ application. V8 Project page:...

cve-2019-11707

SpiderMonkey - CVE-2019-11707 Bug: https://bugs.chromium.org/p/project-zero/issues/detail?id=1820 Screenshots Files exploit.js - Actual exploit, prepended by saelo's util.js & Int64.js. stager.js - Used for creating constants, prepended by saelo's util.js & Int64.js...

CVE-2024-8381

CVE-2024-8381 A SpiderMonkey Interpreter Type Confusion Bug. This repository contains analyses in markdown and slide forms, including root cause, PoC, and exploit. Unfortunately, due to nature of this bug, exploit is only applicable when ASLR is disabled. Slides: Slides.pdf Analysis: Analysis.md...

external_v8_AOSP10_r33_CVE-2020-0240

V8 JavaScript 引擎 V8 是 Google 的开源 JavaScript 引擎。 V8 实现了 ECMA-262 中规定的 ECMAScript 标准。 V8 使用 C++ 编写，并应用于 Google Chrome（Google 的开源浏览器）中。 V8 可以独立运行，也可以嵌入到任何 C++ 应用程序中。 V8 项目页面：https://github.com/v8/v8/wiki 获取代码 检出 depot tools，然后运行 root@kitploit: fetch v8 这将把 V8 检出到目录 v8 中，并获取其所有依赖项。 要保持最新状态，请运行...

CVE-2026-92021

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...

CVE-2026-92040

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

CVE-2026-92021

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...

external_v8_AOSP10_r33_CVE-2021-0396

V8 JavaScript Engine V8 is Google's open source JavaScript engine. V8 implements ECMAScript as specified in ECMA-262. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 can run standalone, or can be embedded into any C++ application. V8 Project page:...

CVE-2024-4761

CVE-2024-4761 High CVE-2024-4761 Exploit Google has released emergency security updates to address a high-severity zero-day vulnerability vulnerability, tracked as CVE-2024-4761, in the Chrome browser. The vulnerability is an out-of-bounds write issue that resides in the V8 JavaScript engine of t...

Chromium CVE-2026-87587: Use after free in V8

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Astra Linux – Vulnerability in Chromium

In Google Chrome versions prior to 87.0.4280.88, uninitialized use of V8 allowed a remote attacker to obtain potentially sensitive information from process memory through a crafted HTML page...

Astra Linux – Vulnerability in Firefox

JIT compilation errors in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3...

Astra Linux – Vulnerability in Chromium

Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Before version 93.0.4577.82, using V8 in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...

CVE-2026-2766-but-with-wasm

CVE-2026-2766，但使用 wasm 状态：已验证的崩溃 PoC，并演示了控制流劫持 （崩溃pc = 调试 shell 下已释放单元的毒化值 0xcdcdcdcdcdcdcdcd ——引擎跳转到一个从已释放的 ICScript 中读出的指针）。 剩余工作：控制被回收的字节。参见 research/README.md。 一个 WasmBlazeFox 家族的利用链，针对 2026 年的一个漏洞：CVE-2026-2766，“JavaScript 引擎：JIT 组件中的 JIT 错误编译 / 释放后使用”， 已在 Firefox 148 中修复（MFSA 2026-13）。最终目标与...