CVE-2026-100825: Use After Free

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

CVE-2026-100814: Improper Restriction of Operations within the Bounds of a Memory Buffer

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

CVE-2026-100792: Undefined Security Weakness

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...

PT-2026-102587

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 157 Firefox versions prior to 157 Description An invalid pointer issue exists within the Just-In-Time JIT component of the JavaScript Engine. JIT is a method of improving program performance by compiling code duri...

PT-2026-102567

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 157 Firefox versions prior to 157 Description An issue exists in the JavaScript Engine component involving JIT Just-In-Time miscompilation. JIT is a method of improving program performance by compiling code during...

CVE-2026-100813: Release of Invalid Pointer or Reference

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

PT-2026-102588

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description Incorrect boundary conditions exist within the JIT Just-In-Time component of the JavaScript Engine. JIT is a method of improving...

CVE-2026-100793: Undefined Security Weakness

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

PT-2026-102599

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists within the JIT Just-In-Time component of the JavaScript Engine. A use-after-free occurs when an...

PT-2026-102566

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description JIT miscompilation occurs in the JavaScript: WebAssembly component. JIT Just-In-Time compilati...

CVE-2026-2796-escape-wasm-by-using-wasm

CVE-2026-2796 — SpiderMonkey WebAssembly 沙箱逃逸 针对 CVE-2026-2796 的概念验证（PoC）利用链，该漏洞是 Mozilla SpiderMonkey 的 WebAssembly 导入优化（“JavaScript: WebAssembly”组件）中的 JIT 错误编译/类型混淆。精心构造的 wasm 模块可获得对整个宿主进程的任意读写 以及任意原生代码执行 能力，从而逃逸 WebAssembly 沙箱。 CVE： CVE-2026-2796（CWE-843，类型混淆） 受影响： Firefox && +...

CVE-2019-17026-Exploit

CVE-2019-17026 - 一个 Firefox JIT 漏洞 原始漏洞由 奇虎360 在野外捕获。 漏洞利用由 maxpl0it 编写。 适用于 Firefox 72.0.1 这是针对 CVE-2190-17026 的漏洞利用： IonMonkey 类型混淆，涉及 StoreElementHole 和 FallibleStoreElement 此漏洞利用不包含沙箱逃逸，因此测试时需要将 about:config 中的 security.sandbox.content.level 属性设置为 0。理论上可以通过 PAC 将本漏洞与 CVE-2020-0674 链式利用，以在...

CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-box

CVE-2026-2796 + CVE-2026-2768 — 逃出 Wasm 沙箱 全链路 Firefox 漏洞利用研究：利用一个 WebAssembly 类型混淆实现渲染器代码执行 ，并串联到父进程漏洞以实现沙箱逃逸 。两个漏洞均在 Firefox 148 （MFSA-2026-13）中修复；这里的目标是 2fbc0748c4（2026-01-14）的 Firefox 148-nightly 代码树，早于这两个修复。 CVE-2026-2796 （Bug 2013165）：SpiderMonkey WebAssembly 导入优化中的 JIT 错误编译/签名类型混淆。...

CVE-2024-29943

CVE-2024-29943 一个 Pwn2Own SpiderMonkey JIT 漏洞：从整数范围不一致到边界检查消除再到 RCE。 基于 https://github.com/bjrjk/CVE-2024-29943 在 Windows 上复现 CVE-2024-29943 修改说明 原漏洞利用代码是针对 Linux 编写的，因此我尝试在 Windows 上复现： 更新了 Windows 下的弹出计算器的 shellcode，并调整了一些堆风水参数。（我尚未完全理解 Windows 堆的工作原理，因此只是调整了一些数值直到稳定。） 使用 Uint8Array 代替 Array...

CVE-2022-28672

CVE-2022-28672 CVE-2022-28672 Foxit PDF Reader 漏洞 - UaF - RCE - JIT Spraying FortiOS、FortiProxy 和 FortiSwitchManager 认证绕过 IOC（CVE-2022-40684） 介绍 最近的 CVE FortiOS / FortiProxy / FortiSwitchManager 已在野外被利用。我们想提供有关该漏洞的额外信息，以便用户能够开始判断自己是否已被入侵。本文中，我们讨论了 FortiOS 7.2.1 的日志启用和...

sfuzz

SFUZZ 开始日期：2021年12月 这是一个基于覆盖引导、基于模拟的灰盒模糊测试器，利用自定义的即时编译器实现接近原生的性能。它的工作原理是将 RISC-V ELF 二进制文件提升为中间表示，然后在执行期间将其 JIT 编译为 x86。在 JIT 编译期间，代码会被插桩，以启用诸如覆盖率跟踪、asan、cmpcov 或基于快照的模糊测试等模糊测试改进功能。 功能 多线程，支持任意数量的线程，且几乎线性扩展 自定义 JIT 编译器，以实现高性能，更重要的是可定制性，这一点 在使用 qemu 等其他解决方案时更难实现 自定义内存管理单元，同样允许高度定制化和非常有用的特性，...

cve-2018-4233

CVE-2018-4233 针对CVE-2018-4233的利用程序，这是WebKit的JIT编译器中的一个bug。已在macOS 10.13.3上的Safari 11.0.3上测试。 更多详情请参见 https://saelo.github.io/presentations/blackhatus18attackingclientsidejitcompilers.pdf 该利用程序通过构建addrof和fakeobj原语，然后按照 http://www.phrack.org/papers/attackingjavascriptengines.html 中所述伪造一个typed...

DEBIAN-CVE-2026-98059

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...

DEBIAN-CVE-2026-97944

In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfigetfunchash The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble...

CVE-2026-97944

In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfigetfunchash The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble...