Skip to content
KitploitKITPLOIT
उपकरणब्लॉग
जमा करें
उपकरणब्लॉग
जमा करें

हैकिंग, पेनटेस्ट और साइबर सुरक्षा उपकरण आपके सुरक्षा शस्त्रागार के लिए!

Kitploit हैकिंग, साइबर सुरक्षा और पेंटेस्टिंग टूल्स की एक निर्देशिका है। कमजोरियों को खोजने, सिस्टम का विश्लेषण करने, परीक्षण को स्वचालित करने और अपनी सुरक्षा को मजबूत करने के लिए नवीनतम प्रोजेक्ट अपडेट खोजें।

··फ़ीड·संपर्क·गोपनीयता·© 2026 Kitploit

टूल निर्देशिका

श्रेणियाँ

सभी श्रेणियाँ देखें
Loading categories
CVE-2026-2766-but-with-wasm — CVE-2026-2766, but with wasm | Kitploit
उपकरण/GitHubGitHub/sneakynachos/cve-2026-2766-but-with-wasm
Vulnerability AnalysisExploitationShellcodePayload DevelopmentBinary Exploitation
GitHubsneakynachos/cve-2026-2766-but-with-wasm

CVE-2026-2766-but-with-wasm

CVE-2026-2766, but with wasm

रिपॉजिटरी देखें
117 दिन पहलेअभी तक समीक्षित नहीं

सबसे लोकप्रिय

सभी देखें →

हमारे समुदाय द्वारा सबसे अधिक उपयोग किए जाने वाले उपकरण खोजें।

सभी उपकरण खोजें

हमारे उपकरणों का संग्रह ब्राउज़ करें

सभी उपकरण देखें →
साझा करें
अनुरोधित भाषा में सामग्री उपलब्ध नहीं है। अंग्रेज़ी संस्करण दिखाया जा रहा है।

CVE-2026-2766, but with wasm

Status: validated crash PoC with demonstrated control-flow hijack (crash pc = freed-cell poison 0xcdcdcdcdcdcdcdcd under the debug shell — the engine jumps to a pointer read out of the freed ICScript). Remaining work: control the reclaimed bytes. See research/README.md.

A WasmBlazeFox-family chain on a 2026 bug: CVE-2026-2766, "JIT miscompilation / use-after-free in the JavaScript Engine: JIT component", fixed in Firefox 148 (MFSA 2026-13). The endgame is the same as CVE-2024-29943-but-with-wasm: turn the primitive into control of a code pointer, and aim it at a WASM JIT page full of shellcode constants.

Root cause

From Mozilla's own regression test comments (bug 2013583, test landed in hg 457b68097f81) and the ICScript Lifetimes SMDOC in :

js/src/jit/JitScript.h
  • During Ion trial inlining, a polymorphic call site transition calls removeInlinedChild → the child's ICScript is removed from inlinedChildren_ but is still referenced by the InliningRoot's inlinedScripts_ vector — and, fatally, by the stale CallInlinedFunction stub still sitting in the caller's IC chain.
  • A compacting GC (gczeal(14, 1), i.e. ZealCompactValue every allocation) moves/evacuates the orphaned ICScript while the stale stub chain keeps the old address.
  • The next call through the old stub dereferences the stale ICScript pointer → use-after-move. In ASAN/fuzzing builds the freed cell is poisoned with 0xe5, giving a very readable crash.

Crash evidence

Vulnerable build: mozilla-central rev b3663be61a1a (2026-01-15 nightly; the fix landed between 2026-01-15 and 2026-02-09 — the Feb-09 nightly survives). Shell: Taskcluster linux64-fuzzing-asan-opt jsshell for that rev (needed for gczeal; release-opt shells lack it).

root@kitploit:~
./js --ion-warmup-threshold=100000 poc.js

== ERROR: AddressSanitizer: SEGV on unknown address 0xe5e5e5e5e5e5e5e5
   The signal is caused by a READ memory access.
   #0-#3 <unknown module>          <- baseline JIT code
   #4 EnterJit / MaybeEnterJit     <- js/src/jit/Jit.cpp
   #10 js::jit::DoCallFallback     <- BaselineIC.cpp (the stale IC chain)
   rdi = 0xe5e5e5e5e5e5e5e5        <- the freed ICScript

The dereference happens in baseline JIT code walking the stale stub chain: control of the reclaimed cell = control of the ICEntry/stub fields the baseline trusts, including the stub code pointer it jumps to.

Exploitation plan (in progress)

root@kitploit:~
orphaned ICScript (this PoC)
  -> compacting GC moves it; stale chain keeps old address
    -> reclaim the old cell with controlled bytes (size-class spray)
      -> baseline reads fake ICEntry -> fake ICStub -> fake code_ pointer
        -> jump into the WASM JIT page shellcode (f64.const immediates,
           FuncExport entry-offset overwrite — see the 2024-29943 repo)

See research/README.md for the full weaponization log. Summary of where it stands:

  • The bug is a use-after-move on a malloc'd (TrailingArray) ICScript — spray-reclaimable in principle with size-classed buffers.
  • The free and the use live microseconds apart inside the final new Ctor(flag) call, with no JS callback point between them; naive sprays either miss the window (reclaim1/2) or churn the IC state away with a zeal GC storm (reclaim3). The stale chain does survive a single plain gc() (purge_check).
  • Next step is engine-allocation analysis under gdb (which allocations land in the freed cell between free and use). gdb doesn't work under OrbStack's x86 emulation, so this wants a native Linux x86-64 box.

The WASM stage itself is already built and demonstrated in CVE-2024-29943-but-with-wasm; only the object-model offsets need re-deriving for this FF149-era build.

Files

  • poc.js — Mozilla's regression test (bug 2013583), verified to crash the 2026-01-15 ASAN jsshell as shown above.

References

  • Advisory: MFSA 2026-13 (Firefox 148)
  • Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=2013583 (restricted)
  • Test landing: hg 457b68097f81
  • Sibling chains: https://github.com/SneakyNachos/CVE-2024-29943-but-with-wasm and https://github.com/SneakyNachos/CVE-2026-2764-but-with-wasm
  • Technique origin: https://github.com/SneakyNachos/WasmBlazeFox
टूल डाउनलोड करें