Browser — PoC Archivehttps://poc.intelseclab.com/tags/browser/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000Firefox SpiderMonkey JIT Miscompilation and Use-After-Free (CVE-2026-2764)https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-2764-firefox-jit-uaf/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-16_cve-2026-2764-firefox-jit-uaf/High severity (CVSS 8.8) — binary · CVE-2026-2764 / MFSA 2026-13. Status: Patched. Affects: Mozilla Firefox (SpiderMonkey JavaScript Engine). Tags: firefox, spidermonkey, jit, uaf, type-confusion, wasm, browser, ionmonkey, baseline, proxy, CVE-2026-2764.binaryHighfirefoxspidermonkeyjituaftype-confusionwasmbrowserionmonkeybaselineproxyCVE-2026-2764WebKit Navigation API Cross-Port canIntercept Bypass (CVE-2026-20643)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-20643-webkit-navigation-api-cross-port/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-20643-webkit-navigation-api-cross-port/Medium severity — web · CVE-2026-20643. Status: PoC. Affects: WebKit (Safari / WebKit-based browsers), Navigation API implementation. Tags: webkit, browser, navigation-api, same-origin-policy, cross-port, javascript, test-page, canintercept.webMediumwebkitbrowsernavigation-apisame-origin-policycross-portjavascripttest-pagecaninterceptLightspeed Classroom Management Weak Authentication / Device Takeover — CVE-2026-30368https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30368-lightspeed-classroom-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-30368-lightspeed-classroom-auth-bypass/High severity — web · CVE-2026-30368. Status: PoC. Affects: Lightspeed Classroom Management (Chrome extension for school device management). Tags: chrome-extension, wasm, jwt, ably, service-worker, education-technology, device-control, browser.webHighchrome-extensionwasmjwtablyservice-workereducation-technologydevice-controlbrowserLadybird Browser WebAssembly ESM Host-Function Use-After-Free RCEhttps://poc.intelseclab.com/pocs/web/2026-07-03_ladybird-wasm-esm-host-function-rce/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_ladybird-wasm-esm-host-function-rce/Critical severity — web · None assigned as of 2026-07-03. Status: Weaponized. Affects: Ladybird web browser (WebContent process, LibWeb / LibWasm). Tags: ladybird, browser, webassembly, wasm-gc, use-after-free, memory-corruption, rce, javascript-engine, sandbox-escape.webCriticalladybirdbrowserwebassemblywasm-gcuse-after-freememory-corruptionrcejavascript-enginesandbox-escapeFirefox Smart Window Private URL Exfiltrationhttps://poc.intelseclab.com/pocs/web/2026-07-03_firefox-smartwindow-private-url-exfil/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_firefox-smartwindow-private-url-exfil/High severity — web · None assigned as of 2026-07-03. Status: PoC. Affects: Firefox Smart Window (AI browsing assistant feature). Tags: firefox, smart-window, ai-assistant, privacy-leak, information-disclosure, url-token-exfiltration, browser, prompt-injection.webHighfirefoxsmart-windowai-assistantprivacy-leakinformation-disclosureurl-token-exfiltrationbrowserprompt-injectionGoogle Chromium V8 Out-of-Bounds Read/Write — Crash PoC (CVE-2026-11645)https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-11645-chrome-v8-oob-crash/Wed, 01 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-01_cve-2026-11645-chrome-v8-oob-crash/High severity (CVSS 8.8) — web · CVE-2026-11645. Status: Incomplete PoC (crash only — no confirmed public RCE chain). Affects: Google Chrome / Chromium — V8 JavaScript and WebAssembly engine. Tags: browser, chrome, v8, javascript, turbofan, out-of-bounds, memory-corruption, zero-day, incomplete-poc, active-exploitation.webHighbrowserchromev8javascriptturbofanout-of-boundsmemory-corruptionzero-dayincomplete-pocactive-exploitationChrome WebGPU Use-After-Free (CVE-2026-5281)https://poc.intelseclab.com/pocs/web/2026-05-18_chrome-webgpu-use-after-free/Mon, 18 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-18_chrome-webgpu-use-after-free/High severity (CVSS 8.8) — web · CVE-2026-5281. Status: Weaponized. Affects: Google Chrome / Chromium WebGPU (Dawn backend). Tags: use-after-free, WebGPU, Chrome, Dawn, GPU, browser, unauthenticated.webHighuse-after-freeWebGPUChromeDawnGPUbrowserunauthenticated