CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom)
Vulnerability ID: CVE-2026-71851
CVSS Score: 9.0
Published: 2026-08-07
A severe, twelve-year-old cryptographic weakness in crypto-js (versions < 4.0.0) generated pseudorandom numbers using a custom Multiply-With-Carry (MWC) algorithm seeded from the non-secure Math.random(). This reduces 128-bit and 256-bit key spaces to just 2^39 and 2^47 possibilities, allowing offline brute-force attacks.
TL;DR
Legacy versions of crypto-js generate weak keys using Math.random() in a custom MWC generator, enabling attackers to systematically brute-force and drain cryptocurrency wallets.
⚠️ Exploit Status: ACTIVE
Technical Details
- CWE ID: CWE-338
- Attack Vector: Network
- CVSS v3.1 Score: 9.0 (Critical)
- Exploit Status: Active In-The-Wild
- Primary Impact: Private Key Compromise and Asset Theft
- Component: CryptoJS.lib.WordArray.random()
Affected Systems
- crypto-js <= 3.3.0
- Legacy web3 wallets
- Decentralized browser extensions using crypto-js 3.x
- Hybrid mobile applications bundling legacy crypto-js dependencies
-
crypto-js: >= 3.1.2-4, < 4.0.0 (Fixed in:
4.0.0)
Code Analysis
Commit: ff1f003
Introduce custom Multiply-With-Carry generator utilizing Math.random()
Commit: b405ff5
Implement wrapper utilizing window.crypto / global.crypto
Exploit Details
- Coinspect: Case study analyzing passive brute-force key reconstruction techniques.
Mitigation Strategies
- Upgrade crypto-js dependency to version 4.0.0 or higher.
- Implement platform-native secure random generation APIs.
- Rotate all cryptographic keys and seed phrases generated under vulnerable versions.
Remediation Steps:
- Verify installed dependencies using npm ls crypto-js.
- Upgrade packages to version 4.0.0 or later.
- Generate new mnemonic phrases and migrate wallet assets to fresh addresses.
References
Read the full report for CVE-2026-71851 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)