Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter — Chrome 152 V8 exploit chaining CVE-2026-85046 and CVE-2026-87491 to corrupt the heap, forge Wasm metadata, and execute native code from the renderer. | Kitploit
Tools/GitHubGitHub/sneakynachos/cve-2026-87491-and-cve-2026-85046-the-bagel-fell-off-the-counter
Memory ForensicsVulnerability AnalysisExploitationShellcodeWeb Application ExploitationBinary Exploitation
GitHubsneakynachos/cve-2026-87491-and-cve-2026-85046-the-bagel-fell-off-the-counter

CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter

Chrome 152 V8 exploit chaining CVE-2026-85046 and CVE-2026-87491 to corrupt the heap, forge Wasm metadata, and execute native code from the renderer.

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository
12 days agoNot yet reviewed

CVE-2026-85046 + CVE-2026-87491

Was doing a ton of reading over at https://github.com/Serotav/Writeups.

Decided to combine 85046 with 87491 and bake in some WASM at the same time.

The basics:

  • Confuse packed object and integer arrays during sort().
  • Skip a write barrier and reclaim a young object with a fake array.
  • Corrupt a Float64Array to read and write the V8 cage.
  • Forge a Wasm exception getter using the private exception symbol.
  • Change a function table while optimized code assumes no side effects.
  • Execute a new target with the old instance's trusted metadata.
  • Alias memory index 6 with the executable Wasm jump table.
  • Overwrite compiled Wasm code and invoke it.

Open run.html in Chrome 152.0.7977.75. Success prints PWNED 2026 directly from the renderer and RAW_NATIVE {"pid":...,"writeCount":11,...} in the page.

To go any further you'd have to have an local priv esc of sorts.

Download Tool