Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Einreichen
ToolsExploitsBlog
Einreichen

Hacking-, PenTest- und Cybersicherheits-Tools für Ihr Sicherheitsarsenal!

Kitploit ist ein Verzeichnis von Hacking-, Cybersicherheits- und Pentesting-Tools. Entdecken Sie die neuesten Projekt-Updates, um Schwachstellen zu finden, Systeme zu analysieren, Tests zu automatisieren und Ihre Sicherheit zu stärken.

FeedsKontaktDatenschutz© 2026 Kitploit

Tool-Verzeichnis

Kategorien

Alle Kategorien anzeigen
Loading categories
CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter — Chrome 152 V8 exploit chaining CVE-2026-85046 and CVE-2026-87491 to corrupt the heap, forge Wasm metadata, and execute native code from the renderer. | Kitploit
Tools/GitHubGitHub/sneakynachos/cve-2026-87491-and-cve-2026-85046-the-bagel-fell-off-the-counter
Memory ForensicsVulnerability AnalysisExploitationShellcodeWeb Application ExploitationBinary Exploitation
GitHubsneakynachos/cve-2026-87491-and-cve-2026-85046-the-bagel-fell-off-the-counter

CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter

Beliebteste

Alle anzeigen →

Entdecken Sie die meistgenutzten Tools unserer Community.

Alle Tools erkunden

Durchsuchen Sie unsere Tool-Sammlung

Alle Tools anzeigen →
Teilen

Chrome 152 V8 exploit chaining CVE-2026-85046 and CVE-2026-87491 to corrupt the heap, forge Wasm metadata, and execute native code from the renderer.

Repository anzeigen
3329vor 22 TagenNoch nicht geprüft
Inhalt in der angeforderten Sprache nicht verfügbar. Englische Version wird angezeigt.

CVE-2026-85046 + CVE-2026-87491

Was doing a ton of reading over at https://github.com/Serotav/Writeups.

Decided to combine 85046 with 87491 and bake in some WASM at the same time.

Went and re-did a stage1.js for an eventual ubuntu LPE I'm cooking.

The basics:

  • Confuse packed object and integer arrays during sort().
  • Skip a write barrier and reclaim a young object with a fake array.
  • Corrupt a Float64Array to read and write the V8 cage.
  • Forge a Wasm exception getter using the private exception symbol.
  • Change a function table while optimized code assumes no side effects.
  • Execute a new target with the old instance's trusted metadata.
  • Alias memory index 6 with the executable Wasm jump table.
  • Overwrite compiled Wasm code and invoke it.

Run ./run.py /path/to/chrome. It serves run.html, makes up to five fresh-profile attempts, and exits as soon as it captures PWNED 2026 from the renderer. Each attempt is limited to 20 seconds.

To go any further you'd have to have an local priv esc of sorts.

Tool herunterladen