## https://sploitus.com/exploit?id=5CCD6B94-96F0-5861-A315-AD92FB0E698D
# CVE-2026-85046
Saw the other POC of this and I thought to myself this is such a nightmare to look at. So I went and simplified the POC and added a jump to your own wasm. Because wasm.
Chrome 152.0.7977.75 can confuse object pointers with integers during `sort()`.
`poc.js` keeps a stale Wasm module reference, replaces its freed cell with a
different module, then calls the replacement through that stale reference.
- `sort()` leaks the Wasm module pointer as an integer.
- The pointer is saved where GC does not track it.
- GC frees the original module wrapper.
- A new attacker module takes the same address.
- The stale pointer executes the attacker module.
Expected output on `.75`: `PWNED 2026`, `identity:true`, `marker:8738`.
Run as a page script with `--js-flags=--expose-gc`.
## How to run
Serve or open `run.html` using Chrome 152.0.7977.75 with
`--js-flags=--expose-gc`. Wait for the page to print `PWNED 2026`.