tag
Browser
Firefox SpiderMonkey JIT Miscompilation and Use-After-Free (CVE-2026-2764)
CVE-2026-2764 is a JIT miscompilation vulnerability in Firefox SpiderMonkey (IonMonkey/Baseline) that leads to type confusion and use-after-free. On new Ctor(...arr) / Reflect.construct with a Proxy as newTarget, the proxy get trap fires while the engine is…
WebKit Navigation API Cross-Port canIntercept Bypass (CVE-2026-20643)
The Navigation API's navigate event exposes an event.canIntercept flag that browsers must set to false for navigations that cross a security boundary the page is not allowed to intercept — including navigations to a different port on the same host. This PoC…
Lightspeed Classroom Management Weak Authentication / Device Takeover — CVE-2026-30368
Lightspeed Classroom Management is a Chrome extension used by schools to monitor and remotely control student Chromebooks. The extension's service worker (running classroom.wasm) generates a JWT used to obtain a token for Lightspeed's Ably real-time channel,…
Ladybird Browser WebAssembly ESM Host-Function Use-After-Free RCE
The PoC targets a lifetime bug in Ladybird's WebAssembly ESM import path: WebAssemblyModule.cpp builds a Wasm::FunctionType as a stack-local value and passes it by reference into createhostfunction(), so the resulting long-lived JS host callback retains a…
Firefox Smart Window Private URL Exfiltration
Firefox's Smart Window assistant exposes getopentabs and searchbrowsinghistory tools that return private tab/history URLs to the model and mark the conversation as containing privateData, but they never mark it as containing untrustedInput even though the…
Google Chromium V8 Out-of-Bounds Read/Write — Crash PoC (CVE-2026-11645)
CVE-2026-11645 is a high-severity out-of-bounds read/write vulnerability in V8, the JavaScript/WebAssembly engine used by Chrome and other Chromium-based browsers. The bug is rooted in V8's TurboFan optimizer: incorrect range analysis for loop-modified or…
Chrome WebGPU Use-After-Free (CVE-2026-5281)
CVE-2026-5281 is a reported WebGPU use-after-free condition in Chrome's Dawn backend. The upstream toolkit provides an aggressive payload generator, scanner, and automated browser runner to reproduce crash-like GPU-failure signals and compare vulnerable vs…