Loading CVE intelligence

CVE-2026-2796

CriticalPublished

JIT miscompilation in the JavaScript: WebAssembly component

Published: Feb 24, 2026
Updated: Jul 15, 2026
Assigning CNA: mozilla
Evidence observed: Aug 24, 2026

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

0.6%

Low · next 30 days

Percentile: 49.3%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Sources

6

CVE-2026-2796-escape-wasm-by-using-wasmPoC
PoC exploit chain for CVE-2026-2796: SpiderMonkey WebAssembly sandbox escape (signature type confusion -> arbitrary R/W -> RCE)
CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-boxExploit
Full Firefox chain: CVE-2026-2796 wasm type confusion -> content-process RCE, plus CVE-2026-2768 parent-process escape analysis (both fixed in Firefox 148)
CVE-2026-2796PoC
Proof-of-concept exploit for CVE-2026-2796, demonstrating the vulnerability and its impact.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

CVE-2026-12295-UXXS-in-my-wasmPoC

Firefox content->parent srcdoc forge (N-day, bug 2040160): forged PDocumentChannel with SrcdocData on a non-about:srcdoc URI -> attacker HTML served at victim origin (UXSS), via mojo-port send-path injection from a compromised content process

CVE-2026-74939-escape-the-mac-n-cheese-boxPoC

Firefox content-to-parent IPDL privilege escalation (N-day, bug 2054416): forged PDocumentChannel with RemoteTypeOverride -> privilegedabout process placement, via mojo-port send-path injection from a compromised content process

cve-2026-2796-reproPoC

Reproduction code for CVE-2026-2796, demonstrating the vulnerability and its impact for security research and validation.