josephfarah-ciso

GitHub · Repository owner · Source ID 316487239
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

josephfarah-ciso/CVE-2026-9999-exploit

Repository PoC0Created 2026-08-13ScannerCVE-2026-99992 files

17.4 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A WebGL-based fuzzing harness that checks for GPU process crashes in vulnerable Chrome versions on macOS. It fingerprints the browser, runs curated shader stress tests, and mutates GLSL to detect context loss events, but does not deliver a payload or achieve code execution.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a self-contained HTML PoC harness for CVE-2026-9999. The harness fingerprints the browser, runs curated WebGL shader triggers, and fuzzes GLSL to hunt for GPU process crashes. All code is client-side JavaScript that operates locally in the browser. No network requests, data exfiltration, remote payloads, or concealed harmful behavior are present. The artifact's behavior is fully consistent with its documented purpose as a research and fuzzing harness.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesHTMLJavaScriptGLSL
Target softwareGoogle ChromeANGLE Metal backend
Attack typesfuzzingvulnerability scanning
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a scanner because it checks for a vulnerability (GPU process crash via WebGL context loss) without exploiting it. The README explicitly states the root cause is not public and the harness is hypothesis-driven, designed to hunt for a crash rather than deliver a payload. The HTML/JS code compiles shaders and monitors for context loss events, which is detection, not exploitation.

README.md:20README.md:42-43README.md:207-208cve-2026-9999-poc.html:53-55

Requirements

  • Chrome version < 148.0.7778.216 on macOS with Metal GPU supportREADME.md:11README.md:58-63

Observed behavior

  • Fingerprints the browser to determine if the Chrome version is below the fixed version 148.0.7778.216cve-2026-9999-poc.html:38-47
  • Compiles and draws eight curated WebGL2 shaders designed to stress the ANGLE Metal shader translatorcve-2026-9999-poc.html:90-108
  • Generates and executes mutated GLSL fragment shaders in a loop, monitoring for WebGL context loss eventscve-2026-9999-poc.html:110-162
  • Logs context loss events and persists crashing shader source to localStorage for later analysiscve-2026-9999-poc.html:53-55cve-2026-9999-poc.html:150-153
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

LocalStorage Key
Payload withheldThe harness saves a crashing shader to localStorage for later retrieval by the operator, as documented in the README.cve-2026-9999-poc.html:152
LocalStorage Key
Payload withheldThe harness saves crash event logs to localStorage for later retrieval by the operator, as documented in the README.cve-2026-9999-poc.html:61-62
Review boundaries

What the analysis did not establish

  • The root cause of CVE-2026-9999 is not public; the harness is based on analyst hypothesis, not a confirmed trigger.
  • The artifact only detects GPU process crashes (context loss); it does not confirm whether a crash is the specific CVE or an unrelated issue.
  • No ASAN build or crash signature is provided to validate findings.
  • The review is limited to the two text files provided; no external dependencies or network resources are fetched or analyzed.
  • The artifact is a hypothesis-driven fuzzing harness for a vulnerability with no public root cause, so its effectiveness in triggering the specific CVE is unverified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.