sneakynachos/cve-2026-2796-and-cve-2026-2768-escape-the-wasm-boxFull Firefox chain: CVE-2026-2796 wasm type confusion -> content-process RCE, plus CVE-2026-2768 parent-process escape analysis (both fixed in Firefox 148)
Full-chain Firefox exploitation research: a WebAssembly type confusion for
renderer code execution, chained toward a parent-process bug for a
sandbox escape. Both bugs were fixed in Firefox 148 (MFSA-2026-13);
the target here is a Firefox 148-nightly tree @ 2fbc0748c4 (2026-01-14),
which predates both fixes.
page loads crafted wasm module
│
CVE-2026-2796: Function.prototype.call.bind unwrap skips signature check
│ → i64 ↔ (ref $t) confusion → addrOf/fakeobj
│ → fake WasmArrayObject → arbitrary R/W in the CONTENT process
│ → forged WasmFuncRef → hijack call target ([funcref+0x38])
▼
native code exec INSIDE the sandboxed content process (sbLevel 3)
│ (sandbox blocks exec/fork — need a parent bug)
▼
CVE-2026-2768: forge IndexedDB add/put IPC with out-of-range
mAutoIncrementKeyOffsets (ParamTraits<Key> validates nothing)
│ → parent writes 8 bytes at attacker-controlled offset
▼
memory corruption in the UNSANDBOXED parent process = full escape
| Demo | Where | Result |
|---|---|---|
poc/shell/poc-crash.js | js shell | 0xDEADBEEF dereferenced as funcref → SIGSEGV at 0xdeadbf2f |
poc/shell/poc-addrof.js | js shell | arbitrary R/W self-tests pass |
poc/shell/poc-forge.js | js shell | PC control: crash at planted canary |
poc/shell/poc-rce.js | js shell | system("id > /tmp/CVE-2026-2796-PWNED; open -a Calculator") — file contains uid=501(sid) ..., Calculator pops |
poc/browser/stage1-browser.html | Nightly (sbLevel 3 content) | arbitrary R/W in the sandboxed tab; forged funcref jumps to 0x4141414141414141 → tab crashes, parent survives |
poc/browser/stage1-browser-cmd.html | Nightly (sbLevel 3 content) | leaks XUL base, resolves posix_spawnp (0x187xxxxx), calls it with /bin/sh -c "touch /tmp/PWNED-FROM-CONTENT" → macOS sandbox denies the exec: file not created, page unharmed — proof that content RCE alone ≠ command execution |
poc/browser/sandbox-proof.html | Nightly (sbLevel 3 content) | native exec within sandbox rules: getpid() returns the tab's real PID (matches ps), and raw libc write(1, ...) lands in the browser's terminal log — no fork/exec, no file opens |
poc/browser/fd3-proof.html | Nightly (sbLevel 3 content) | writes 32 raw bytes onto fd 3 (the parent IPDL socket): the parent's IPC parser consumes attacker bytes (Message needs unreceived descriptors ... num_handles:33), drops the message and kills the tab ("Exiting due to channel error") — the transport primitive that stage 2 weaponizes with well-formed-but-malicious IndexedDB messages |
poc/browser/stage2-trigger.html | Nightly | pure-JS reachability of the parent bug path (auto-increment index keys [1,2,3,4]) |
See docs/full-escape.md for the stage-2 root-cause analysis (fix diffs, IPC serialization, exploitation strategy).
# Tree: mozilla-firefox/firefox @ 2fbc0748c4 (2026-01-14, pre-FF148)
# 1) js shell (stage-1 development, unsandboxed):
cd js/src && ../../configure --enable-debug --enable-optimize \
--without-intl-api --enable-project=js && cd _obj && make -j8
# 2) full browser (stage 2). mozconfig:
# export CC=/usr/bin/clang ; export CXX=/usr/bin/clang++
# ac_add_options --enable-application=browser
# ac_add_options --disable-debug --enable-optimize
# ac_add_options --disable-crashreporter --disable-updater --disable-tests
# ac_add_options --enable-sandbox
# ac_add_options --without-wasm-sandboxed-libraries
# requires: node, cbindgen, rustc >= 1.87, macOS CLT SDK
# local build notes:
# - private header sys/fileport.h shim added to objdir dist/include/sys/
# - one compile guard added: NSGlassEffectView (macOS 26 SDK symbol) wrapped
# in #if __MAC_OS_X_VERSION_MAX_ALLOWED >= 260000 in widget/cocoa/
# nsCocoaWindow.mm (build-environment fix, no security impact)
Run browser PoCs: launch obj-browser/dist/Nightly.app with a profile that
sets browser.dom.window.dump.enabled=true, open the HTML files over
file://, watch stdout for dump() output. Tab crash appears as
process <pid> exited on signal 10 in the parent log.
WasmArrayObject: numElements @+16, data ptr @+24, inline data @+40.
WasmFuncRef: typeDef ptr @+0x40, call target @+0x38. JSFunction native
ptr @+0x20. js shell: os_system @ base+0x1a9f8, system GOT @
base+0x11d47b0. Browser: XUL base found by scanning back from a WebIDL
native code pointer (console.log JSFunction +0x20) to the 0xfeedfacf
Mach-O magic; _posix_spawnp GOT @ XUL+0x9bb7d30, _getpid GOT @
XUL+0x9bb7600, _write GOT @ XUL+0x9bb87e0. Fake-array windows must
live in an out-of-line (malloc'd) array — inline/nursery objects get moved
by GC during long scans.
Renderer code execution via CVE-2026-2796 is fully demonstrated (shell and browser). The sandbox escape analysis of CVE-2026-2768 is source-verified against the fix diff; the live end-to-end parent-corruption trigger is a work in progress (see docs). This research is for defensive/educational use; the vulnerabilities are patched in current releases.
e2acef67c5dea6ecFor security research, education, and defensive testing only. Do not use against systems you do not own or have explicit authorization to test.