CVE-2021-38297-Go-wasm-Replication

🚨 CVE-2021-38297 の悪用: GO Wasm バッファオーバーフローへの道のり 🚨 🌐 脆弱性の概要 🌐 WebAssembly WASM 🌍 は、C、C++、Rust、GO などの高級言語を最新の Web ブラウザーでシームレスに実行できるようにする、最先端のバイナリ命令形式です。しかし、CVE-2021-38297 🚩 の発見により、GO でコンパイルされた WASM バイナリに対する GO のコンパイルおよびロード処理に重大な欠陥があることが明らかになりました。GO が提供する JavaScript WASM ローダー wasmexec.js...

CVE-2026-15718-who-put-ptrs-in-my-wasm

CVE-2026-15718 — 谁把指针放进了我的 wasm 针对 CVE-2026-15718 的概念验证漏洞利用链，该漏洞是 Mozilla SpiderMonkey 的 WebAssembly baseline 编译器（"JavaScript: WebAssembly" 组件）中一处缺失 sync 的错误编译。单个零次循环的 array.fill 即可产生 fakeobj 原语；该利用链可升级为对宿主进程的任意读/写 以及任意本机代码执行 （posixspawnp"/bin/sh", ...）。 CVE： CVE-2026-15718（CWE-763，无效指针的释放） 受影响版本...

CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-box

CVE-2026-2796 + CVE-2026-2768 — 逃出 Wasm 沙箱 全链路 Firefox 漏洞利用研究：利用一个 WebAssembly 类型混淆实现渲染器代码执行 ，并串联到父进程漏洞以实现沙箱逃逸 。两个漏洞均在 Firefox 148 （MFSA-2026-13）中修复；这里的目标是 2fbc0748c4（2026-01-14）的 Firefox 148-nightly 代码树，早于这两个修复。 CVE-2026-2796 （Bug 2013165）：SpiderMonkey WebAssembly 导入优化中的 JIT 错误编译/签名类型混淆。...

CVE-2024-12381

CVE-2024-12381 CVE-2024-12381 是 Chrome V8 引擎中的一个 WebAssembly 类型规范化漏洞，其中 CanonicalEquality::EqualValueType 未能考虑索引引用类型中的可空性。结合基于 JSPI 的 V8 沙箱绕过（CVE-2024-12692），该漏洞可实现远程代码执行。 服务器从 User-Agent 中提取 Chrome 版本并对浏览器进行指纹识别。易受攻击的浏览器会被自动重定向到漏洞利用载荷，而已修补的浏览器则会看到一个外观正常的仪表板。 使用方法 1. 安装依赖：pip install flask 2...

BLACKHAT_Asia2023

BLACKHATAsia2023 关于 BLACKHAT USA2022 PDF 公开 文件列表，搜索你感兴趣的内容。 BLACKHATAsia2023 ├── AS-23-Babkin-firmWar-An-Imminent-Threat-to-the-Foundation-of-Computing.pdf ├── AS-23-Bai-Stealthy-Sensitive-Information-Collection-from-Android-Apps.pdf ├── AS-23-Cao-Attacking-WebAssembly-Compiler-of-Webkit.pdf ├──...

EUVD-2026-81605

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...

CVE-2026-92040

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...

vpod v0.8.4

Vpod Live demo • Getting Started • Documentation • Issues • Contributing What is a vpod ? A vpod is a lightweight, portable sandbox that gives an untrusted process an instant Linux environment. It uses a RISC‑V architecture and runs entirely inside WebAssembly. Fast startup : Boot in under a...

Linux Distros Unpatched Vulnerability : CVE-2026-92040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. CVE-2026-92040 Note that Nessus relies...

SUSE CVE-2026-92040

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

CVE-2026-92040

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

CVE-2026-92040

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

UBUNTU-CVE-2026-92040

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

EUVD-2026-78503

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

CVE-2026-92040 Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

CVE-2026-92040

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

CVE-2026-92040 Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

CVE-2026-92040

A use-after-free vulnerability exists in the JavaScript: WebAssembly component of Mozilla Firefox and Thunderbird . This flaw was addressed in versions 156 of both products. While the vulnerability is confirmed, specific details regarding the root cause, technical impact, or exploit availability ...

CVE-2026-92040: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156...

PT-2026-91976

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 156 Thunderbird versions prior to 156 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a memory corruption flaw that occurs when an application continues to use a...