## https://sploitus.com/exploit?id=9E8D4955-A682-5151-B96D-1F6A0ADE5599
# CVE-2026-85046 + CVE-2026-87491
Was doing a ton of reading over at https://github.com/Serotav/Writeups.
Decided to combine 85046 with 87491 and bake in some WASM at the same time.
The basics:
- Confuse packed object and integer arrays during `sort()`.
- Skip a write barrier and reclaim a young object with a fake array.
- Corrupt a `Float64Array` to read and write the V8 cage.
- Forge a Wasm exception getter using the private exception symbol.
- Change a function table while optimized code assumes no side effects.
- Execute a new target with the old instance's trusted metadata.
- Alias memory index 6 with the executable Wasm jump table.
- Overwrite compiled Wasm code and invoke it.
Open `run.html` in Chrome 152.0.7977.75. Success prints `PWNED 2026` directly from the renderer and `RAW_NATIVE {"pid":...,"writeCount":11,...}` in the page.
To go any further you'd have to have an local priv esc of sorts.