Reverse engineering Claude's CVE-2026-2796 exploit

This post details how Claude Opus 4.6 was used to reverse-engineer and author an exploit for CVE-2026-2796, a JIT miscompilation vulnerability in Firefox's WebAssembly component. It explains the vulnerability's root cause, involving type confusion due to a fast path optimization for `Function.prototype.call.bind` wrappers that bypasses the JavaScript/WebAssembly interop layer. The post also outlines Claude's exploit development workflow, including its plan to build `addrof` and `fakeobj` primitives using WebAssembly to achieve arbitrary read/write capabilities, demonstrating an advancement in AI's ability to generate cyber exploits.