CVE-2026-2796

CRITICAL

Firefox < 148.0 - Type Confusion in JavaScript WebAssembly JIT

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-2796. PoCs published by WostGit.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2026-2796, demonstrating memory corruption primitives (addrof and fakeobj) in Firefox using WebAssembly (WAT). The exploit leverages WAT text compilation to achieve reliable address leakage and object forgery.

Description

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Exploits (2)

nomisec WORKING POC
by WostGit · poc
https://github.com/WostGit/CVE-2026-2796

This repository contains a functional exploit PoC for CVE-2026-2796, demonstrating memory corruption primitives (addrof and fakeobj) in Firefox using WebAssembly (WAT). The exploit leverages WAT text compilation to achieve reliable address leakage and object forgery.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Reliable
Target: Firefox 147.0, 148.0.2
No auth needed
Prerequisites: Firefox 147.0 or 148.0.2 · WebAssembly support
devstral-2 · analyzed Apr 09, 2026 Full analysis →
nomisec WORKING POC
by WostGit · poc
https://github.com/WostGit/cve-2026-2796-repro

This repository contains a functional proof-of-concept for CVE-2026-2796, a Wasm JIT type confusion vulnerability in Firefox. The GitHub Actions workflow automates the download of vulnerable Firefox versions and executes a precise reproduction script to demonstrate the vulnerability.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Firefox < 148.0
No auth needed
Prerequisites: Firefox 147.0 or earlier · WebAssembly support
devstral-2 · analyzed Apr 09, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 9.8
EPSS 0.0003
EPSS Percentile 9.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-843
Status published
Products (4)
mozilla/firefox < 148.0
Mozilla/Firefox 148
mozilla/thunderbird < 148.0
Mozilla/Thunderbird 148
Published Feb 24, 2026
Tracked Since Feb 24, 2026