Skip to content
KitploitKITPLOIT
OutilsBlog
Soumettre
OutilsBlog
Soumettre

Outils de Hacking, PenTest et Cybersécurité pour votre Arsenal de Sécurité !

Kitploit est un répertoire d'outils de hacking, de cybersécurité et de pentesting. Découvrez les dernières mises à jour des projets pour trouver des vulnérabilités, analyser des systèmes, automatiser les tests et renforcer votre sécurité.

··Flux·Contact·Confidentialité·© 2026 Kitploit

Répertoire d'outils

Catégories

Voir toutes les catégories
Loading categories
CVE-2026-2766-but-with-wasm — CVE-2026-2766, but with wasm | Kitploit
Outils/GitHubGitHub/sneakynachos/cve-2026-2766-but-with-wasm
Vulnerability AnalysisExploitationShellcodePayload DevelopmentBinary Exploitation
GitHubsneakynachos/cve-2026-2766-but-with-wasm

CVE-2026-2766-but-with-wasm

CVE-2026-2766, but with wasm

Voir le dépôt
1il y a 17 joursPas encore vérifié

Populaires

Voir tout →

Découvrez les outils les plus utilisés par notre communauté.

Explorer tous les outils

Parcourez notre collection d'outils

Voir tous les outils →
Partager
Contenu non disponible dans la langue demandée. Affichage de la version anglaise.

CVE-2026-2766, but with wasm

Status: validated crash PoC with demonstrated control-flow hijack (crash pc = freed-cell poison 0xcdcdcdcdcdcdcdcd under the debug shell — the engine jumps to a pointer read out of the freed ICScript). Remaining work: control the reclaimed bytes. See research/README.md.

A WasmBlazeFox-family chain on a 2026 bug: CVE-2026-2766, "JIT miscompilation / use-after-free in the JavaScript Engine: JIT component", fixed in Firefox 148 (MFSA 2026-13). The endgame is the same as CVE-2024-29943-but-with-wasm: turn the primitive into control of a code pointer, and aim it at a WASM JIT page full of shellcode constants.

Root cause

From Mozilla's own regression test comments (bug 2013583, test landed in hg 457b68097f81) and the ICScript Lifetimes SMDOC in :

js/src/jit/JitScript.h
  • During Ion trial inlining, a polymorphic call site transition calls removeInlinedChild → the child's ICScript is removed from inlinedChildren_ but is still referenced by the InliningRoot's inlinedScripts_ vector — and, fatally, by the stale CallInlinedFunction stub still sitting in the caller's IC chain.
  • A compacting GC (gczeal(14, 1), i.e. ZealCompactValue every allocation) moves/evacuates the orphaned ICScript while the stale stub chain keeps the old address.
  • The next call through the old stub dereferences the stale ICScript pointer → use-after-move. In ASAN/fuzzing builds the freed cell is poisoned with 0xe5, giving a very readable crash.

Crash evidence

Vulnerable build: mozilla-central rev b3663be61a1a (2026-01-15 nightly; the fix landed between 2026-01-15 and 2026-02-09 — the Feb-09 nightly survives). Shell: Taskcluster linux64-fuzzing-asan-opt jsshell for that rev (needed for gczeal; release-opt shells lack it).

root@kitploit:~
./js --ion-warmup-threshold=100000 poc.js

== ERROR: AddressSanitizer: SEGV on unknown address 0xe5e5e5e5e5e5e5e5
   The signal is caused by a READ memory access.
   #0-#3 <unknown module>          <- baseline JIT code
   #4 EnterJit / MaybeEnterJit     <- js/src/jit/Jit.cpp
   #10 js::jit::DoCallFallback     <- BaselineIC.cpp (the stale IC chain)
   rdi = 0xe5e5e5e5e5e5e5e5        <- the freed ICScript

The dereference happens in baseline JIT code walking the stale stub chain: control of the reclaimed cell = control of the ICEntry/stub fields the baseline trusts, including the stub code pointer it jumps to.

Exploitation plan (in progress)

root@kitploit:~
orphaned ICScript (this PoC)
  -> compacting GC moves it; stale chain keeps old address
    -> reclaim the old cell with controlled bytes (size-class spray)
      -> baseline reads fake ICEntry -> fake ICStub -> fake code_ pointer
        -> jump into the WASM JIT page shellcode (f64.const immediates,
           FuncExport entry-offset overwrite — see the 2024-29943 repo)

See research/README.md for the full weaponization log. Summary of where it stands:

  • The bug is a use-after-move on a malloc'd (TrailingArray) ICScript — spray-reclaimable in principle with size-classed buffers.
  • The free and the use live microseconds apart inside the final new Ctor(flag) call, with no JS callback point between them; naive sprays either miss the window (reclaim1/2) or churn the IC state away with a zeal GC storm (reclaim3). The stale chain does survive a single plain gc() (purge_check).
  • Next step is engine-allocation analysis under gdb (which allocations land in the freed cell between free and use). gdb doesn't work under OrbStack's x86 emulation, so this wants a native Linux x86-64 box.

The WASM stage itself is already built and demonstrated in CVE-2024-29943-but-with-wasm; only the object-model offsets need re-deriving for this FF149-era build.

Files

  • poc.js — Mozilla's regression test (bug 2013583), verified to crash the 2026-01-15 ASAN jsshell as shown above.

References

  • Advisory: MFSA 2026-13 (Firefox 148)
  • Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=2013583 (restricted)
  • Test landing: hg 457b68097f81
  • Sibling chains: https://github.com/SneakyNachos/CVE-2024-29943-but-with-wasm and https://github.com/SneakyNachos/CVE-2026-2764-but-with-wasm
  • Technique origin: https://github.com/SneakyNachos/WasmBlazeFox
Télécharger l’outil