CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture cross-origin information leak. Safari Red/Green/Blue/White Fixed version = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Principle GPUDevice.importExternalTexturesource: HTMLVideoElement imports a video into a GPU-samplable...

WebKit-Bug-256172

WebKit-Bug-256172 Safari 1day RCE Exploit, might be patched in iOS 16.5.1/macOS 13.4.1 Confirmed exploit works on macOS 13.3.1, iOS 15.8.2. Description Currently only works on macOS 13.0.1 x8664 due to hardcoded offsets. Implemented addrof/fakeobj, r/w primitive Patch...

Relapse-Exploit

PS5 Relapse Exploit Supported firmware: 7.00 through 13.60. Usage The default payloads are stored in payloads/ after a successful run, the ELF loader listens on port 9021. Stability notes Webkit may need several attempts, reload the page if the browser stalls. The kernel exploit may hang or panic...

PS4-6.20-WebKit-Code-Execution-Exploit

PS4 6.20 WebKit Code Execution PoC This repo contains a proof-of-concept PoC RCE exploit targeting the PlayStation 4 on firmware 6.20 leveraging CVE-2018-4441. The exploit first establishes an arbitrary read/write primitive as well as an arbitrary object address leak in wkexploit.js. It will then...

CVE-2026-47423-dompurify-xss-detector

DOMPurify re-clone logic flaw. Instead of relying on easily stripped source comments or version variables, this tool performs logic fingerprinting on minified production JavaScript bundles to identify unpatched allowed-tag layouts. Vulnerability Summary In DOMPurify versions up to 3.4.4, the...

CVE-2026-20643

CVE-2026-20643 CVE-2026-20643 test page diff: https://github.com/WebKit/WebKit/commit/850ce3163e55ebaa33f712d05681e5522b518806 https://www.flvin.com/blogs/2026/03/20/CVE-2026-20643/...

CVE-2025-24201-WebKit-Vulnerability-Detector-PoC-

CVE-2025-24201 WebKit Vulnerability Detector PoC This proof-of-concept detects whether a WebKit-based browser is vulnerable to CVE‑2025‑24201 , a high-severity out-of-bounds write vulnerability caused by incorrect capability validation in the WebGL implementation. 🔍 Vulnerability Summary...

CVE-2018-4416-exploit

Preface :PROPERTIES: :CUSTOMID: preface :END: OKay, binary security is not only /heap/ and /stack/, we still have a lot to discover despite regular CTF challenge. Browser, Virtual Machine, and Kernel all play an important role in binary security. And I decide to study browser first. I choose a...

PS5-IPV6-Kernel-Exploit

PS5 3.xx / 4.xx Kernel Exploit Summary This repo contains an experimental WebKit ROP implementation of a PS5 kernel exploit based on TheFlow's IPV6 Use-After-Free UAF , which was reported on HackerOne. The exploit strategy is for the most part based on TheFlow's BSD/PS4 PoC with some changes to...

webkit-vulnerability

webkit-vulnerability CVE-2016-4657 web-kit vulnerability for ios 9.3, nintendo switch browser vulnerability iknow whats running in your mind nintendo switch has no no browser, but when you neetd to use a wifi which needs to be conformed by logging in to the browser CVE-2016-45657 webkit in safari...

totally-not-spyware

TotallyNotSpyware This program is definitely not spyware. Run it on your 64-bit iOS device as soon as possible. Your compliance will be rewarded. Live version at totally-not.spyware.lol Repo structure & building Frontend and WebKit exploit are in /root. Kernel exploit is in /glue. Post-exploitati...

CVE-2019-8601

Exploiting CVE-2019-8601 This is an exploit for a WebKit vulnerability that was originally discovered by Fluoroacetate during the pwn2own competition in Vancouver. While I did not discover this bug, I wrote this exploit to practice my exploit development skills. The original writeup for this...

CVE-2020-17057

I wrote this exp based on this blog（https://blogs.360.cn/post/CVE-2020-17057%20detail%20and%20exploit.html），But I ended up with only palette objects with dangling data pointer. Because of type isolation, I can't get arbitrary R/W primitives by using palettes or bitmap objects，If you have a way to...

PS5-UMTX-Jailbreak

PSFree version 1.4.0 PSFree is a WebKit exploit using CVE-2022-22620 to gain arbitrary read/write. vulnerable: PS4 6.xx-9.xx tested 6.00-9.60 PS5 1.xx-5.xx tested 1.00-5.50 CREDITS: anonymous for PS4 firmware kernel dumps janisslsm from ps4-dev on discord.com contributed ROP chain managers for 8....

Bad_Hoist-WriteUp

Sleirsgoevy's version of BadHoist Write-up | CVE-2018-4386 !Note Background information about the PS4: The PlayStation 4 Console features a custom AMD x86-64 CPU 8 cores, it's Orbis OS is based on FreeBSD v9.0 with parts of NetBSD as well. It also includes a wide variety of additional open source...

jitsploitation

jitsploitation iOS browser exploit for CVE-2020-9802, an old JIT bug. This is an exploit for a popular JIT compiler bug in the WebKit engine for macOS and iOS originally documented by Project Zero. I re-implemented the exploit for this bug as an exercise in learning browser exploitation. Video...

CVE-2025-43541

CVE-2025-43541 WARNING: POTENTIALLY UNSAFE CODE This repository contains a JavaScript / HTML Proof of Concept PoC related to a potential WebKit / JavaScriptCore vulnerability identified as CVE-2025-43541. Disclaimer This code may be unsafe. Running this HTML file can crash the browser, especially...

pwn2own2020

Compromising the macOS Kernel through Safari by Chaining Six Vulnerabilities Overview This repository contains exploitation and technical details of our Pwn2Own 2020 winning submission targeting Apple Safari with a kernel escalation of privilege for macOS 10.15.3. For further information, you can...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — Same-Origin Policy bypass via cross-port interception CVE-2026-20643 | ---|--- CVE| CVE-2026-20643 Discovered by| Thomas Espach WebKit Bugzilla 306050 Component| WebKit — WebCore::Navigation::innerDispatchNavigateEvent Affected| iOS 26.3.1...

WebKit-UAF-ANGLE-OOB-Analysis

WebKit-UAF-ANGLE-OOB-Analysis CVE-2025-43529, CVE-2025-14174 Notes and PoC material for a WebKit/ANGLE chain on iOS 26.1. This is not a full exploit; it separates verified primitives from the pieces that still fail. Author: zeroxjf Based on: jir4vv1t's CVE-2025-43529 exploit Status: Partial chain...