CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter

CVE-2026-85046 + CVE-2026-87491 Was doing a ton of reading over at https://github.com/Serotav/Writeups. Decided to combine 85046 with 87491 and bake in some WASM at the same time. Went and re-did a stage1.js for an eventual ubuntu LPE I'm cooking. The basics: Confuse packed object and integer...

CVE-2026-9973-exploit

CVE-2026-9973 Bug fix https://chromium-review.googlesource.com/c/v8/v8/+/7822799 wasmturboshaft Fix Phi handling in Load Elimination some more Multiple Phis can depend on each other, so we have to clear all their replacements up front. Fixed: 509268941 Change-Id:...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 Details this proof of concept exploit targets Safari 11.0.3 13604.5.6 on macOS 10.13.3 17D47 versions only. compile the payload of your choice as a dylib with a constructor run python filetojsarray.py your.dylib payload.js...

CVE-2025-31125

CVE-2025-31125 Exploit - Vite WASM Import Path Traversal 🛡️ This script is a proof-of-concept PoC exploit for CVE-2025-31125 , a vulnerability found in Vite. The exploit leverages a WASM Import Path Traversal issue to retrieve sensitive files from vulnerable servers running the Vite framework. It...

CVE-2024-2887

CVE-2024-2887 This is a short writeup for the CVE-2024-2887, which I used to claim V8CTF M123. When define more types than kV8MaxWasmTypes, which can be achieved by padding more types in RecGroup, the types index can be more than 20bits and then overflowed. Then two types can be considered same a...

CVE-2026-6307-Longinus

CVE-2026-6307-Longinus Type Confusion in V8 TurboFan JS-to-Wasm call inlining + FrameState merging Better Known as 'Longinus': 2 Boundaries in One Bug Repository: https://github.com/J4ck3LSyN-Gen2/CVE-2026-6307-Longinus Detailed Report: OS-IS-CVE-2026-6307-07-2026.md Technical Write-up: Nebula...

CVE-2024-1939

CVE-2024-1939 This is a short writeup for the CVE-2024-1939, which I used to claim V8CTF M122. The root cause of this issue is the lack of support for kWasmS128 in wasm-to-js conversion. Specifically, wasmS128Const operations occurring in parameter stacks are ignored, leading to type confusion wh...

CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.

CVE-2026-85046 + CVE-2026-87491 + CVE-2026-87606 + CVE-2026-87575 Talk about a giant pain to sneak a path out of the renderer. 550 mg of caffiene and going up and down chrome CVE's all night, you too can bounce out of the renderer. CVE-2026-85046 corrupts a Float64Array for V8-cage read/write...

CVE-2026-6307

CVE-2026-6307: V8 JS-to-Wasm type confusion → RCE on Chrome 146 Local reproduction and weaponization of the V8 JS-to-Wasm deoptimization type confusion described by Nebula, taken to a xcalc popped from the renderer of Chrome for Testing 146.0.7680.165 the bug is fixed in 147.0.7727.101. All...

ephemora-cell

Ephemora-cell Ephemora-cell is an ephemeral, stateless, capability-bound execution boundary for untrusted AI and agent-generated code. create → constrain → execute → prove → destroy Every execution starts from a clean state, runs under limits the host granted — fuel, memory, time, I/O, output siz...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 Details this proof of concept exploit targets Safari 11.0.3 13604.5.6 on macOS 10.13.3 17D47 versions only. compile the payload of your choice as a dylib with a constructor run python filetojsarray.py your.dylib payload.js...

Project-Onyx

Project Onyx Advanced EDR Evasion via AI Telemetry Spoofing & WASM Sandboxing. Project Onyx is a PoC Red Team pipeline designed to demonstrate advanced evasion techniques against modern EDR systems. It shifts away from traditional signature-based obfuscation towards behavioral camouflage and stri...

amla-sandbox

amla-sandbox This repository is the release source for the amla-sandbox Python package. Development happens in the amlalabs monorepo; this repo is updated on release. The Rust runtime that compiles to amlasandbox.wasm lives in amla-sandbox-core; the exact release tag this Python package was built...

trivy-module-wordpress

Trivy WoredPress Module This module provides a more in-depth investigation of Wordpress detection. Set up $ tinygo build -o wordpress.wasm -scheduler=none -target=wasi --no-debug wordpress.go $ mkdir -p /.trivy/modules $ cp wordpress.wasm /.trivy/modules It is also available in GHCR. You can...

CVE-2024-2887-REPORT

SSD Advisory – Google Chrome RCE Source: ssd-disclosure.com/ssd-advisory-google-chrome-rce Summary A critical remote code execution vulnerability in Google Chrome versions 123 and earlier affecting WebAssembly WASM garbage-collection type handling. The bug allows type confusion that can be...

CVE-2021-38297

Exploiting CVE-2021-38297: Vulnerability in GO Wasm Buffer Overflow Overview of the Vulnerability WebAssembly WASM serves as a binary instruction format executable in most modern web browsers. It acts as a compilation target for various high-level languages like C, C++, Rust, and GO, allowing cod...

CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm

CVE-2026-85046 Saw the other POC of this and I thought to myself this is such a nightmare to look at. So I went and simplified the POC and added a jump to your own wasm. Because wasm. Chrome 152.0.7977.75 can confuse object pointers with integers during sort. poc.js keeps a stale Wasm module...

CVE-2026-2764-but-with-wasm

CVE-2026-2764, but with wasm Status: analysis + validated PoC. Primitive weaponization in progress. A WasmBlazeFox-style chain built on a 2026 bug this time: CVE-2026-2764, an IonMonkey/baseline "JIT miscompilation + use-after-free" in the JavaScript Engine: JIT component, fixed in Firefox 148 MF...

CVE-2026-2766-but-with-wasm

CVE-2026-2766, but with wasm Status: validated crash PoC with demonstrated control-flow hijack crashpc = freed-cell poison 0xcdcdcdcdcdcdcdcd under the debug shell — the engine jumps to a pointer read out of the freed ICScript. Remaining work: control the reclaimed bytes. See research/README.md. ...

V8-sbx-bypass-collection

V8 Sandbox escape/bypass/violation and VR collection A collection of links related to V8 sandbox VR and exploitation Contents IssueTracker Articles Papers & Slides Design documents IssueTracker 2023: "issue id: 40940619, V8 Sandbox escape due to type tags in ExternalPointerTable being too coarse...