A Firefox NaN sandbox escape found by Mythos

A floating-point NaN bit pattern could masquerade as a tagged pointer across a Firefox sandbox boundary, making a numerical edge case into an exploit primitive

The most delightful bug that Mythos found in Firefox is a NaN vulnerability. There are many bit representations of floating point not-a-number, one of which looks like a tagged representation of a pointer except on SPARC. You can ship it a

Ranked #7 on backlist 2026-05-11 (11 May 2026 UTC) · by @geoffreyirving (Geoffrey Irving) · view on X ↗

How it ranks: Backlist reads my Twitter/X timeline, scores every tweet for substance with an LLM rubric (not engagement), and publishes the daily top picks with a one-line takeaway. Curated by Surya Dantuluri.