CVE-2018-12386

HIGH

Mozilla Firefox JavaScript Register Allocation - Type Confusion Code Execution

Title source: manual

Exploitation Summary

EIP tracks 2 public exploits for CVE-2018-12386. PoCs published by 0xLyte, Hydra3evil.

AI-analyzed exploit summary This is a functional exploit for CVE-2018-12386, a Firefox RCE vulnerability. It leverages a type confusion bug to achieve arbitrary memory read/write, leading to remote code execution in a sandboxed environment.

Description

A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.

Exploits (2)

nomisec WORKING POC 2 stars

by 0xLyte · poc

https://github.com/0xLyte/cve-2018-12386

View Code ZIP pw:eip

This is a functional exploit for CVE-2018-12386, a Firefox RCE vulnerability. It leverages a type confusion bug to achieve arbitrary memory read/write, leading to remote code execution in a sandboxed environment.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Complex

Reliability

Reliable

Target: Firefox < 62.0.3 and Firefox ESR < 60.2.2

No auth needed

Prerequisites: Specific Linux setup with known offsets · Firefox version prior to 62.0.3 or ESR 60.2.2 · Sandbox disabled for testing (MOZ_DISABLE_CONTENT_SANDBOX=1)

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec WORKING POC 2 stars

by Hydra3evil · poc

https://github.com/Hydra3evil/cve-2018-12386

View Code ZIP pw:eip

This repository contains a functional proof-of-concept exploit for CVE-2018-12386, a remote code execution vulnerability in Firefox versions prior to 62.0.3 and Firefox ESR 60.2.2. The exploit leverages a sandboxed RCE in Firefox on Linux, requiring specific offsets for the target environment.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Complex

Reliability

Reliable

Target: Firefox < 62.0.3, Firefox ESR < 60.2.2

No auth needed

Prerequisites: Firefox version prior to 62.0.3 or Firefox ESR prior to 60.2.2 · Linux environment with known offsets for libxul.so and libc.so.6 · Sandbox disabled (MOZ_DISABLE_CONTENT_SANDBOX=1)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →