JIT miscompilation use-after-free in Firefox SpiderMonkey IonMonkey

This repository is a real exploit kit centered on CVE-2026-10702, described as a Firefox JavaScript JIT miscompilation issue fixed in Firefox 151.0.3. The structure is split into: (1) a browser exploit front-end in CyberMeowfia/IonStack/CVE-2026-10702/index.html and exploit.html, (2) a Python HTTP server/dashboard in c2_server.py, (3) a native ARM payload in payload/arm_payload.c, and (4) post-exfil analysis helpers in analyze_cookies.py and decrypt_passwords.py, plus listener.py for a simple TCP command channel. The main exploit path is browser/web-based. index.html acts as the launcher/orchestrator UI, repeatedly loading exploit.html in child frames and handling progress/success/failure messages via postMessage. exploit.html contains the actual JavaScript exploitation logic, including JIT-oriented primitives, device fingerprint gating, and command/result reporting. It targets Android Firefox app storage, explicitly referencing /data/data/org.mozilla.firefox/files and a supported device fingerprint string. The exploit appears intended to achieve code execution or privileged command execution from the browser context, then stage native actions. The included ARM payload is overtly malicious in capability: it hardcodes a C2 host (172.40.1.237:8000), performs HTTP GET exfiltration to /exfil and file uploads to /upload, enumerates Firefox-related directories, and uploads databases and preference files likely to contain cookies, credentials, history, tokens, and session artifacts. It also gathers system information and runs automatically via a constructor after forking into the background. This moves the repository beyond a pure proof-of-concept into an operational exploit with built-in exfiltration. c2_server.py provides the operator infrastructure: an exploit server on port 8000 and a dashboard on port 8001 with /dashboard and /api/captures. It stores exfiltrated data under a local Windows path D:/kuliah/magang/CVE-2026-10702/exfil_data. The helper scripts then parse stolen Firefox artifacts: analyze_cookies.py reads cookies/form history from SQLite databases, while decrypt_passwords.py inventories and attempts to process logins.json, key4.db, cookies.sqlite, places.sqlite, and session storage. listener.py is a separate simple TCP listener on port 4444 for interactive communications. Overall, the repository’s purpose is not just vulnerability demonstration; it is an end-to-end exploitation and data theft toolkit for vulnerable Android Firefox targets, with hosting, collection, dashboarding, and offline analysis components.

Repository contains a browser-delivered exploit proof of concept for CVE-2026-10702, described as a Firefox JavaScript JIT miscompilation issue fixed in Firefox 151.0.3. The core code lives under CyberMeowfia/IonStack/CVE-2026-10702/ with three relevant files: exploit.html (main exploit), index.html (launcher/controller UI), and ansi.js (ANSI log rendering helper). The top-level and nested READMEs are mostly disclaimers and attribution. The main exploit logic is in exploit.html. It is a large JavaScript payload that sets up low-level numeric conversion helpers, heap/object-shape grooming, and JIT-oriented primitives consistent with memory corruption exploitation in a browser engine. It uses parent/child window messaging to coordinate execution state, user confirmation, progress, and final success/failure. The code includes Android-specific assumptions, notably the Firefox app-private path /data/data/org.mozilla.firefox/files, a supported-device allowlist, and shell command orchestration. The visible polling loop shows command execution output being collected from files and status markers using /system/bin/printf, /system/bin/cat, and /system/bin/tail, indicating post-exploitation command execution capability rather than mere crash testing. index.html acts as the operator-facing harness. It spawns exploit.html as a child frame with run/attempt tokens, manages retries/timeouts, prompts the user when a device fingerprint is reported, receives progress/success/failure messages via postMessage, and displays logs. ansi.js is only a presentation helper for colored terminal-style output. Overall, this is not a detector or a fake sample; it is an operational browser exploit PoC aimed at Android Firefox, with explicit post-exploitation shell-command execution and output capture. It appears capable of causing instability or reboot on unsupported devices and is more than a simple crash reproducer.

Repository contains two separate exploit projects. IonStack/CVE-2026-10702 is a browser-based HTML/JavaScript exploit targeting Firefox on Android. It consists mainly of index.html, exploit.html, and ansi.js. The browser component manages repeated attempts in hidden frames, fingerprints the device via build ID checks, communicates with a parent frame using postMessage, and includes logic to run/poll shell-style commands and report progress/success/failure. It is a browser attack vector rather than a standalone native payload. IonStack/CVE-2026-43499 is the primary native exploit set and is a mature Android local privilege-escalation project written mostly in C with target-specific headers and source overrides. The Makefile builds an ARM64 preload.so shared object plus an embedded su daemon binary. Execution is via LD_PRELOAD, and the constructor in src/preload.c automatically launches run_exploit(). The exploit chain includes: KASLR/kernel base leakage (slide.c), fake file-operations / race routing stages (fops.c), heap shaping and pipe-buffer abuse to obtain kernel physical read/write primitives (pipe.c), and credential/SELinux manipulation to gain root (root.c). It also embeds a post-exploitation payload that installs a su binary in /apex/com.android.virt/bin/su and /data/local/tmp/su, starts a root UNIX socket daemon at /data/local/tmp/temp_su.sock, and modifies wallpaper/system files. Repository structure is modular: shared core sources under exploit/src, helper code under exploit/src/kernelsnitch, and many target profiles under exploit/src/targets/<device-build>. Several target directories are thin wrappers that include a common implementation (notably tokay/frankel families), while ace3 has more extensive target-specific overrides. CI builds multiple target variants and packages preload-<project>.so artifacts. Overall purpose: deliver operational Android LPE exploits for specific 2026-era device builds, with both exploitation and persistence/convenience payload components rather than mere vulnerability detection.

Repository contains two distinct exploit projects under IonStack. CVE-2026-10702 is a browser-based Firefox Android exploit implemented as HTML/JavaScript. index.html acts as the launcher/UI, repeatedly loading exploit.html in child frames, handling user confirmation, device fingerprint gating, progress reporting, and success/failure messaging via postMessage. exploit.html contains the actual browser exploit logic, including device checks, memory-manipulation primitives, and command polling/reporting. ansi.js is only a UI helper for ANSI-colored logs. CVE-2026-43499 is the larger and more mature component: a local Android ARM64 privilege-escalation exploit with many device-specific target profiles. The build system compiles a preload.so shared object and an embedded su_daemon binary. Core source layout is modular: main.c orchestrates the exploit stages and thread choreography; slide.c performs KASLR bypass/leak or forced fixed-base handling; fops.c builds the ashmem file_operations hijack and configfs-based arbitrary kernel read/write stage; pipe.c develops a pipe-buffer-based physical memory read/write primitive; root.c patches credentials/capabilities/SELinux and validates root; preload.c is the constructor-driven loader and post-exploitation installer; su_daemon.c provides a local root shell service over a UNIX domain socket. The exploit chain for CVE-2026-43499 is clearly intended to achieve full local root. It uses futex PI/requeue and pselect/TCP-based stack-copy routing to corrupt kernel waiter structures, overwrite ashmem misc fops with a forged fake_fops table, then leverage configfs callbacks for controlled kernel memory access. After that it installs a stronger pipe-based physical R/W primitive, locates task/cred structures, sets uid/gid to 0, adjusts capabilities, disables SELinux enforcement, and drops a su binary plus a root shell daemon. There are also optional direct /dev/mem helper paths that attempt a simpler overwrite if the device permits it. Repository structure shows heavy per-device specialization. Many target directories are thin wrappers including shared tokay or frankel implementations, while target.h files define build fingerprints and kernel offsets for each supported build. PROGRESS.md indicates the Xiaomi jinghu path is still under active development and not fully reliable yet, but the codebase overall is a real exploit repository rather than a detector or placeholder.

Repository contains two distinct exploit projects. CVE-2026-10702 is a browser/HTML+JavaScript exploit targeting Firefox on Android. It consists mainly of index.html, exploit.html, and ansi.js. index.html acts as a controller UI that spawns exploit.html in iframes, handles retries/timeouts, and receives progress/success/failure via postMessage. exploit.html contains the actual browser exploit logic: device fingerprint gating, memory-corruption-style primitives, command execution/polling logic, and reporting back to the parent frame. It references Firefox private app storage and appears intended for browser-only exploitation with Android command execution as the end goal. CVE-2026-43499 is the larger and more operational exploit. It is a local Android ARM64 privilege-escalation exploit built as an LD_PRELOAD shared object via the included Makefile and CI workflow. The codebase is organized into reusable core files (main.c, slide.c, fops.c, pipe.c, root.c, preload.c, su_daemon.c, kernelsnitch helpers) plus many per-device target directories containing build fingerprints and kernel offsets. The exploit chain performs: KASLR slide disclosure (slide.c), fake file_operations / routing stages (fops.c), pipe-based physical kernel read/write primitive construction (pipe.c), credential and SELinux manipulation (root.c), and post-exploitation persistence/utility actions (preload.c + su_daemon.c). The payload installs an embedded su binary under /apex/com.android.virt/bin/su, drops a local client to /data/local/tmp/su, starts a root daemon on UNIX socket /data/local/tmp/temp_su.sock, and can execute commands or provide an interactive root shell. It also writes wallpaper files and restarts system_server to force wallpaper reload. The repository is not a framework module; it is standalone exploit code. It is clearly a real exploit rather than a detector: it contains kernel memory primitives, target-specific offsets, root credential patching, SELinux disable attempts, and a working post-exploitation payload. The target coverage includes multiple Google Pixel-family build fingerprints and OnePlus Ace3, with many target directories reusing shared source through include indirection. CI builds preload.so artifacts for several named projects and even documents adb-based deployment using LD_PRELOAD.

Repository is a research/adaptation project for the GhostLock local privilege-escalation chain targeting CVE-2026-43499 on OPPO Find X6 Pro (PGEM10, Android 15, Linux 5.15.149 ARM64). It is not a simple README-only repo: it contains modified exploit source, reusable KASLR-leak code, standalone test programs, Python kernel-analysis tooling, and extensive reports documenting why the original exploit chain fails on this PAC-enabled target. Core exploit capability: the code orchestrates a futex PI race using FUTEX_LOCK_PI, FUTEX_WAIT_REQUEUE_PI, and FUTEX_CMP_REQUEUE_PI across waiter/owner/consumer threads. The original chain aims to reclaim/shape kernel stack data via pselect, forge an rt_mutex_waiter, overwrite file_operations pointers (ashmem/configfs confusion), gain arbitrary kernel read/write through pipe_buffer manipulation, then patch credentials and SELinux state for root. The modified adaptation replaces the original SLIDE KASLR leak with a working perf_event_open-based callchain leak implemented in exploit-src/main_modified.c and src/kaslr_perf.c. That module samples kernel callchains from PERF_TYPE_SOFTWARE / PERF_COUNT_SW_CPU_CLOCK events, extracts deep kernel return addresses, and derives the runtime kernel base/slide. Main exploit files: exploit-src/main_modified.c is the primary adapted entry point; it adds perf_kaslr_leak(), invokes perf_event_open, mmaps the perf ring buffer, parses PERF_RECORD_SAMPLE records, computes kaslr_base/kaslr_slide, then proceeds into the futex race orchestration. exploit-src/slide_modified.c contains the original SLIDE/pselect stack-copy logic and fake waiter construction, including fd_set shaping and timerfd/pipe descriptor setup, but the repo documentation states this stage is blocked on the target because PAC/BTI inflate futex-related stack frames beyond the reachable pselect overwrite depth. common_modified.h contains key exploit constants and declarations, including Android ashmem ioctl definitions, mm_struct sizing changes (0x500 -> 0x400), pipe/cred/SELinux helper declarations, and kernel-address macros. Repository structure: exploit-src/ holds original vs modified exploit sources for comparison; src/ contains the reusable perf-based KASLR bypass module; tests/ contains standalone utilities for KASLR leakage, futex hash analysis, KASLR brute force, path/bucket analysis, and attack-surface checks (Dirty Pipe, OverlayFS, netfilter/nftables visibility); analysis-scripts/ contains Python ELF/call-graph tooling that scans a local vmlinux.elf for PACIASP prologues, BL edges, and deep call chains; reports/ and docs/ contain detailed adaptation notes, offset verification, architecture diagrams, build logs, and failure analysis. Notable findings from the repo’s own analysis: the adaptation successfully validates offsets, mm_struct sizing, and the futex trigger, and provides a reliable KASLR bypass on the target. However, the full LPE chain is not completed on the documented OPPO device because ARM PAC causes futex call-chain stack depth (~0xA70) to exceed the pselect overwrite depth (~0x620), preventing the SLIDE/fops-overwrite stage from landing. Thus this repo is best characterized as an operational local exploit adaptation with a working KASLR-leak payload and partial exploit chain, rather than a fully successful end-to-end root exploit for the documented target.

Repository contains two distinct exploit tracks. The first, IonStack/CVE-2026-10702, is a browser-based JavaScript/HTML exploit targeting Firefox on Android. It uses index.html as an orchestrator that spawns exploit.html in child frames, exchanges status via postMessage, fingerprints the device using build identifiers, and appears to drive a command-execution workflow while reporting progress/results back to the parent UI. It is a browser attack vector, not just a detector. The second and much larger component, IonStack/CVE-2026-43499/exploit, is a local Android kernel privilege-escalation exploit written primarily in C for arm64 and built as a preload shared object. The Makefile builds preload.so and an embedded su daemon binary for multiple device-specific targets. Core structure: main.c coordinates the race/exploit flow; slide.c leaks KASLR; fops.c corrupts/rewrites file_operations-related state via ashmem/configfs primitives; pipe.c establishes kernel physical read/write using forged pipe buffers; root.c patches credentials and SELinux-related state to obtain root; preload.c acts as constructor entry point and post-exploitation installer; su_daemon.c provides a root command/interactive shell service over a UNIX socket; target.h files encode per-device kernel offsets and build fingerprints. Exploit capability for CVE-2026-43499 is substantial: it leaks kernel base, gains arbitrary kernel read/write, locates and patches task/cred structures, attempts to set SELinux permissive, spawns a root child, installs a su binary into /apex/com.android.virt/bin/su and /data/local/tmp/su, starts a daemon on /data/local/tmp/temp_su.sock, and modifies wallpaper files. The repository includes many target profiles for Google Android builds (blazer, caiman, comet, frankel, komodo, mustang, rango, stallion) and one OPPO PJA110 profile. Several target directories override common files with device-specific exploit logic and offsets. Overall, this is a real exploit repository with operational post-exploitation payloads, not a fake or detection-only project.

Repository contains two distinct exploit projects. CVE-2026-10702 is a browser-only HTML/JavaScript exploit for Firefox on Android. Its structure is small: index.html is the launcher/UI wrapper, exploit.html contains the main exploitation logic, and ansi.js renders colored logs. The browser exploit uses iframe/parent postMessage coordination, fingerprints the device via build ID, gates execution with user confirmation, and appears to run commands while polling output/status files via Android shell utilities. It is clearly an exploit rather than a detector. CVE-2026-43499 is the larger component: a local Android ARM64 kernel privilege-escalation exploit written in C with a Makefile-based build system. The codebase is organized into reusable core files (main.c, fops.c, pipe.c, slide.c, root.c, preload.c, su_daemon.c, common.h, kernelsnitch helpers) plus many target-specific directories under src/targets containing build fingerprints and kernel offsets for numerous Google device codenames and one OPPO target. The exploit chain includes: KASLR leak via slide.c, fake file_operations / pselect-futex race logic in fops.c, pipe-based physical read/write primitive in pipe.c, credential and SELinux patching in root.c, and post-exploitation persistence/utility actions in preload.c. Main capabilities of CVE-2026-43499: obtain arbitrary kernel read/write, locate and patch current task credentials, elevate to uid 0, attempt SELinux permissive mode, install an embedded su binary, start a root daemon over UNIX socket /data/local/tmp/temp_su.sock, optionally expose su inside adbd mount namespace, and modify wallpaper/system state. The embedded su daemon supports both interactive shells and one-shot command execution using /system/bin/sh. The exploit is operational and tailored to specific Android builds rather than broadly weaponized. Notable repository structure: many duplicated target variants (blazer, caiman, comet, frankel, komodo, mustang, rango, stallion, tegu, oppo-find_n2) each define BUILD_FINGERPRINT and kernel symbol/structure offsets. This indicates the exploit is highly dependent on exact kernel layout and intended for real-device exploitation across selected Android 16/17 builds.