Claude Opus 4.6 and the CVE-2026-2796 Exploit

Claude Opus 4.6 has demonstrated the ability to autonomously author a functional exploit for CVE-2026-2796, a JIT miscompilation vulnerability in the JavaScript WebAssembly component of Firefox. While the exploit required a testing environment with reduced security features and was not a "full-chain" escape from the browser sandbox, it marks a significant milestone in the trajectory of LLM cyber capabilities.

Technical Root Cause of CVE-2026-2796

CVE-2026-2796 is a type confusion vulnerability occurring at the import/export boundary between JavaScript and WebAssembly (Wasm).

The Type Safety Boundary

Normally, Firefox ensures type safety through two mechanisms:

  1. Instantiation-time checks: Wasm functions must match declared type signatures.
  2. Runtime conversion: JavaScript-backed imports pass through an interop layer that converts Wasm values to JS values, preventing raw bits from being reinterpreted.

The Optimization Failure

The vulnerability exists in a "fast path" optimization within MaybeOptimizeFunctionCallBind(). When a Wasm module imports a function wrapped in Function.prototype.call.bind(...), the engine unwraps the wrapper and stores the inner target function directly in the import record without verifying that the unwrapped function's type signature matches the import's declared type.

While the standard calling path (Instance::callImport) remains safe due to the JS interop layer, the getExportedFunction() path does not perform this check. When Wasm code uses ref.func to reference an imported function, it receives the unwrapped target function. If this function is called via call_ref, the execution bypasses the JS interop layer entirely, allowing parameters to be passed as raw bytes. This results in type confusion where Module A writes bytes based on its declared type, but Module B reads them based on its own different type.

Claude's Exploit Development Process

Anthropic provided Claude Opus 4.6 with a virtual machine, a task verifier, and the vulnerability details. To succeed, Claude had to read a secret file and write an exfiltration file to a target system using a stripped-down version of the Firefox js shell.

The Exploit Primitive Chain

Claude decomposed the goal into a classical browser exploit chain:

  1. Type Confusion: Use the vulnerability to create a controlled pointer dereference.
  2. Information Leak (addrof): Leak an object's address as an integer.
  3. Reference Forgery (fakeobj): Forge a JS object reference to an arbitrary address.
  4. Arbitrary Read/Write: Use addrof and fakeobj to create a fake ArrayBuffer with a controlled backing store pointer.
  5. Code Execution: Overwrite function pointers to achieve arbitrary code execution.

Implementation of Read/Write Primitives

Claude utilized the WebAssembly GC proposal's struct types to bypass the "chicken-and-egg" problem of needing arbitrary write to achieve arbitrary write.

By casting an externref to a struct reference and using struct.get (which is a memory load at a fixed offset), Claude created a read primitive. Similarly, struct.set was used to create a write64 primitive. These primitives allowed Claude to manipulate the process's address space and eventually construct the fake ArrayBuffer required for full arbitrary read/write.

Implications for AI Cyber Capabilities

This case study indicates that frontier models are approaching the ability to author complex exploits.

Model Comparison

Opus 4.6 was the only model in the evaluation to succeed. Other tested models—including Opus 4.1, 4.5, Sonnet 4.5, 4.6, and Haiku 4.5—failed to produce the exploit. Anthropic attributes this success to Opus 4.6's increased persistence and superior programming abilities.

Risk Assessment

Anthropic notes that this result represents the "capability floor" of Opus 4.6. The ability to translate type confusion into exploit primitives without sophisticated heap manipulation suggests that motivated attackers using LLMs could significantly accelerate the speed of exploit development.

"This is a moment to move quickly—to empower cyberdefenders to secure as much code as possible in order to raise the skill level required for cybercriminals to misuse LLMs’ cyber capabilities."

Anthropic intends to expand its cybersecurity efforts by helping developers search for vulnerabilities, triage bug reports, and propose patches.

Sources

Related