SneakyNachos/CVE-2026-2796-and-CVE-2026-2768-escape-the-wasm-box

PoC

Full Firefox chain: CVE-2026-2796 wasm type confusion -> content-process RCE, plus CVE-2026-2768 parent-process escape analysis (both fixed in Firefox 148)

view exploit source poc_in_githubauthor SneakyNachospublished 2026-08-20catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2026-2796UScritical9.8Exploit
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan