crixpwn/cve-2026-8389

This repository documents a security vulnerability in Firefox's SpiderMonkey JavaScript engine. It was prepared for the Pwn2Own 2026 Berlin competition but was patched in Firefox version 150.0.3 before the competition took place. The vulnerability is a bitfield truncation in the baseline JIT compiler. SpiderMonkey's JIT stores the bytecode offset for each compiled call site in a 28-bit field inside a data structure called RetAddrEntry. The maximum allowed script length was sized to match those 28 bits. However, that length check only ran on the main-thread compilation path. A separate eager off-thread baseline compilation path skipped the check entirely, so a JavaScript script whose bytecode exceeded 256 MB could pass through the off-thread path without being rejected. When that happened, the stored offset was silently truncated to fit the 28-bit field. The truncated offset is read back during exception handling. SpiderMonkey converts the stored offset to a bytecode pointer and passes it to the exception handler to match try-note entries for the current execution point. Because the truncated offset is still within the bounds of the script's bytecode buffer, the access does not immediately crash. Instead, the exception handler works with the wrong bytecode position, reads an incorrect stack slot, and treats a non-object value as if it were a JavaScript object. That type confusion is the starting point for further exploitation. The repository includes annotated C++ code excerpts from the affected source files, showing the construction and storage of the offset, the gating check that was missing on the off-thread path, and the call chain through which the truncated value reaches the exception handler.