Baseline

Firefox SpiderMonkey JIT Miscompilation and Use-After-Free (CVE-2026-2764)

CVE-2026-2764 is a JIT miscompilation vulnerability in Firefox SpiderMonkey (IonMonkey/Baseline) that leads to type confusion and use-after-free. On new Ctor(...arr) / Reflect.construct with a Proxy as newTarget, the proxy get trap fires while the engine is…