PoC Archive PoC Archive
CVE-2026-2764 / MFSA 2026-13 category: binary CVSS 8.8 (HIGH)
Unverified

Firefox SpiderMonkey JIT Miscompilation and Use-After-Free (CVE-2026-2764)

Published: 2026-08-16 • Researcher: SneakyNachos

Target software Mozilla Firefox (SpiderMonkey JavaScript Engine)
Affected versions Firefox before 148, ESR before 115.33 and 140.8
Status Patched
Severity High · CVSS 8.8
CVSS 8.8/10
Severity
High
CVE
CVE-2026-2764 / MFSA 2026-13
Category
binary
Affected product
Mozilla Firefox (SpiderMonkey JavaScript Engine)
Affected versions
Firefox before 148, ESR before 115.33 and 140.8
Disclosed
2026-08-16
Patch status
Unverified

Archive entry

intelseclab/poc-archive
On this page

Metadata

FieldValue
Date Added2026-08-16
Last Updated2026-08-16
Author / ResearcherSneakyNachos
CVE / AdvisoryCVE-2026-2764 / MFSA 2026-13
Categorybinary
SeverityHigh
CVSS Score8.8 (browser RCE)
StatusPatched
Tagsfirefox, spidermonkey, jit, uaf, type-confusion, wasm, browser, ionmonkey, baseline, proxy, CVE-2026-2764

Affected Target

FieldValue
Software / SystemMozilla Firefox (SpiderMonkey JavaScript Engine)
Versions AffectedFirefox before 148, ESR before 115.33 and 140.8
Language / PlatformJavaScript (SpiderMonkey jsshell PoCs)
Authentication RequiredNone – victim visits attacker-controlled page
Network Access RequiredRemote – deliver via web page

Summary

CVE-2026-2764 is a JIT miscompilation vulnerability in Firefox SpiderMonkey (IonMonkey/Baseline) that leads to type confusion and use-after-free. On new Ctor(...arr) / Reflect.construct with a Proxy as newTarget, the proxy get trap fires while the engine is between spreading arguments and creating this. The callback can mutate or free the spread array while the engine continues with stale assumptions.

Two PoC variants (verbatim Mozilla regression tests): type confusion (int swapped to object mid-spread) and UAF (elements store freed via GC mid-spread).

Vulnerability Details

Root Cause

PortableBaselineInterpret.cpp routed scripted-constructor this-creation through CreateThisFromIC which re-read IC state. The fix (hg 1b58f51668d3) calls js::CreateThis directly with properly rooted values.

Attack Flow

  1. JIT warmup: Iterate class hierarchy with super(…arr) to trigger compilation
  2. Proxy trigger: Reflect.construct with Proxy newTarget whose get handler mutates/frees the array
  3. Type confusion: arr[0] swapped from int to object after spread snapshot
  4. UAF: arr.length = 0; gc() frees elements store mid-spread

Impact

  • Type confusion primitive leads to addrof/fakeobj
  • UAF leads to dangling pointer access
  • Full chain: type confusion -> TypedArray corruption -> arbitrary R/W -> WASM JIT shellcode

Environment / Lab Setup

Shell script 
1
2

./js poc-typeconfusion.js   # -> Assertion failed: got "oops", expected 1
./js poc-uaf.js             # -> Segmentation fault

Proof of Concept

Two JS files mirrored from SneakyNachos/CVE-2026-2764-but-with-wasm. Both are verbatim Mozilla regression tests.

poc-typeconfusion.js (28 lines)

Proxy get handler swaps arr[0] from integer to “oops” after JIT-compiled spread snapshot.

poc-uaf.js (36 lines)

Proxy get handler sets sharedArr.length = 0 and calls gc(), freeing elements store mid-spread.

Detection and Indicators of Compromise

Output

Remediation

ActionDetail
PatchUpdate Firefox to 148+, ESR to 115.33+ or 140.8+.
WorkaroundDisable JIT via about:config (performance impact).
VerificationRun PoCs in jsshell – patched builds print “no crash” messages.

References

Notes

Two minimal JS files screened (28 and 36 lines). Verbatim Mozilla regression tests – no exploitation payload. Type confusion produces assertion failure; UAF produces segfault. No binaries, no network activity. Author documents splice plan for WASM JIT shellcode stage. Verified against 2026-02-09 mozilla-central nightly jsshell.