Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm — Proof-of-concept exploit for CVE-2026-85046 in Chrome 152.0.7977.75, demonstrating type confusion in sort() to achieve arbitrary code execution via a stale Wasm module reference. | Kitploit
Tools/GitHubGitHub/sneakynachos/cve-2026-85046-who-put-the-silverback-guerilla-in-the-wasm
Vulnerability AnalysisExploitationWeb Application ExploitationBinary Exploitation
GitHubsneakynachos/cve-2026-85046-who-put-the-silverback-guerilla-in-the-wasm

CVE-2026-85046-who-put-the-silverback-guerilla-in-the-wasm

Proof-of-concept exploit for CVE-2026-85046 in Chrome 152.0.7977.75, demonstrating type confusion in sort() to achieve arbitrary code execution via a stale Wasm module reference.

View Repository
18h 4m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-85046

Saw the other POC of this and I thought to myself this is such a nightmare to look at. So I went and simplified the POC and added a jump to your own wasm. Because wasm.

Chrome 152.0.7977.75 can confuse object pointers with integers during sort(). poc.js keeps a stale Wasm module reference, replaces its freed cell with a different module, then calls the replacement through that stale reference.

  • sort() leaks the Wasm module pointer as an integer.
  • The pointer is saved where GC does not track it.
  • GC frees the original module wrapper.
  • A new attacker module takes the same address.
  • The stale pointer executes the attacker module.

Expected output on .75: PWNED 2026, identity:true, marker:8738.

Run as a page script with --js-flags=--expose-gc.

How to run

Serve or open run.html using Chrome 152.0.7977.75 with --js-flags=--expose-gc. Wait for the page to print PWNED 2026.

Download Tool