Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-2766-but-with-wasm — CVE-2026-2766, but with wasm | Kitploit
Tools/GitHubGitHub/sneakynachos/cve-2026-2766-but-with-wasm
Vulnerability AnalysisExploitationShellcodePayload DevelopmentBinary Exploitation
GitHubsneakynachos/cve-2026-2766-but-with-wasm

CVE-2026-2766-but-with-wasm

CVE-2026-2766, but with wasm

View Repository
117 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-2766, but with wasm

Status: validated crash PoC with demonstrated control-flow hijack (crash pc = freed-cell poison 0xcdcdcdcdcdcdcdcd under the debug shell — the engine jumps to a pointer read out of the freed ICScript). Remaining work: control the reclaimed bytes. See research/README.md.

A WasmBlazeFox-family chain on a 2026 bug: CVE-2026-2766, "JIT miscompilation / use-after-free in the JavaScript Engine: JIT component", fixed in Firefox 148 (MFSA 2026-13). The endgame is the same as CVE-2024-29943-but-with-wasm: turn the primitive into control of a code pointer, and aim it at a WASM JIT page full of shellcode constants.

Root cause

From Mozilla's own regression test comments (bug 2013583, test landed in hg 457b68097f81) and the ICScript Lifetimes SMDOC in js/src/jit/JitScript.h:

  • During Ion trial inlining, a polymorphic call site transition calls removeInlinedChild → the child's is removed from but is still referenced by the 's vector — and, fatally, by the stale stub still sitting in the caller's IC chain.
ICScript
inlinedChildren_
InliningRoot
inlinedScripts_
CallInlinedFunction
  • A compacting GC (gczeal(14, 1), i.e. ZealCompactValue every allocation) moves/evacuates the orphaned ICScript while the stale stub chain keeps the old address.
  • The next call through the old stub dereferences the stale ICScript pointer → use-after-move. In ASAN/fuzzing builds the freed cell is poisoned with 0xe5, giving a very readable crash.

    • Crash evidence

    Vulnerable build: mozilla-central rev b3663be61a1a (2026-01-15 nightly; the fix landed between 2026-01-15 and 2026-02-09 — the Feb-09 nightly survives). Shell: Taskcluster linux64-fuzzing-asan-opt jsshell for that rev (needed for gczeal; release-opt shells lack it).

    root@kitploit:~
    ./js --ion-warmup-threshold=100000 poc.js

== ERROR: AddressSanitizer: SEGV on unknown address 0xe5e5e5e5e5e5e5e5
   The signal is caused by a READ memory access.
   #0-#3 <unknown module>          <- baseline JIT code
   #4 EnterJit / MaybeEnterJit     <- js/src/jit/Jit.cpp
   #10 js::jit::DoCallFallback     <- BaselineIC.cpp (the stale IC chain)
   rdi = 0xe5e5e5e5e5e5e5e5        <- the freed ICScript

    The dereference happens in baseline JIT code walking the stale stub chain: control of the reclaimed cell = control of the ICEntry/stub fields the baseline trusts, including the stub code pointer it jumps to.

    Exploitation plan (in progress)

    root@kitploit:~
    orphaned ICScript (this PoC)
  -> compacting GC moves it; stale chain keeps old address
    -> reclaim the old cell with controlled bytes (size-class spray)
      -> baseline reads fake ICEntry -> fake ICStub -> fake code_ pointer
        -> jump into the WASM JIT page shellcode (f64.const immediates,
           FuncExport entry-offset overwrite — see the 2024-29943 repo)

    See research/README.md for the full weaponization log. Summary of where it stands:

    • The bug is a use-after-move on a malloc'd (TrailingArray) ICScript — spray-reclaimable in principle with size-classed buffers.
    • The free and the use live microseconds apart inside the final new Ctor(flag) call, with no JS callback point between them; naive sprays either miss the window (reclaim1/2) or churn the IC state away with a zeal GC storm (reclaim3). The stale chain does survive a single plain gc() (purge_check).
    • Next step is engine-allocation analysis under gdb (which allocations land in the freed cell between free and use). gdb doesn't work under OrbStack's x86 emulation, so this wants a native Linux x86-64 box.

    The WASM stage itself is already built and demonstrated in CVE-2024-29943-but-with-wasm; only the object-model offsets need re-deriving for this FF149-era build.

    Files

    • poc.js — Mozilla's regression test (bug 2013583), verified to crash the 2026-01-15 ASAN jsshell as shown above.

    References

    • Advisory: MFSA 2026-13 (Firefox 148)
    • Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=2013583 (restricted)
    • Test landing: hg 457b68097f81
    • Sibling chains: https://github.com/SneakyNachos/CVE-2024-29943-but-with-wasm and https://github.com/SneakyNachos/CVE-2026-2764-but-with-wasm
    • Technique origin: https://github.com/SneakyNachos/WasmBlazeFox
    Download Tool