tag
Javascript-Engine
V8 Array Iterator Maglev Type Confusion — addrof/fakeobj Primitives (CVE-2026-14431)
Array.prototypeSymbol.iterator.next() is miscompiled by V8's Maglev JIT tier: ArrayIteratorPrototypeNext fails to re-check the map (elements kind) of an inlined array after a side effect can change it mid-call, leading to a type confusion between…
V8 JavaScript Engine Exploit — "Longinus" Kit (CVE-2026-6307)
A full V8 exploit kit targeting CVE-2026-6307, comprising a JavaScript trigger/exploit (poc.js), Python generation and validation tooling (gen.py, val.py) for producing and testing exploit payload variants, and a YARA detection rule for the resulting…
Ladybird Browser WebAssembly ESM Host-Function Use-After-Free RCE
The PoC targets a lifetime bug in Ladybird's WebAssembly ESM import path: WebAssemblyModule.cpp builds a Wasm::FunctionType as a stack-local value and passes it by reference into createhostfunction(), so the resulting long-lived JS host callback retains a…