Preliminary research

Out of Bounds, Out of Sandbox: RCE in Go JavaScript Engine

Dylan Pindur and Adam Kues · Searchlight Cyber · 7 September 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

A TypedArray offset bug in Goja gives JavaScript code access beyond its buffer. The research connects this corruption to Go runtime objects and native calls, developing a script-to-host escape with published exploit artifacts and build-dependent constraints.

Record

Researcher

Dylan Pindur and Adam Kues

Published by

Searchlight Cyber

Date

7 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Goja exploit and vulnerable template

Tags

• memory-corruption
• sandbox-escape
• rce
• javascript
• go

This page is the archive's own catalogue record. The research is the work of Dylan Pindur and Adam Kues, first published at the original source. Preserved copies are kept so the citation survives its host.