CVE-2026-85045

CVE-2026-85045 A training poc I cooked up while going after the larger chains. Maglev reuses one mutable HeapNumber while materializing recursive deoptimization frames. The exact upstream trigger produces 0,3,3,3 on both 148 builds and 152.0.7977.75, versus 0,1,2,3 on fixed 152.0.7977.82. Load...

CVE-2026-85046-Patch-confusion-zero-day-vulnerability-in-Google-Chrome-s-V8-engine

CVE-2026-85046: Chrome V8 Type Confusion Patch This repository contains the conceptual C++ patch for the critical zero-day vulnerability in Google Chrome's V8 JavaScript and WebAssembly engine CVE-2026-85046. Overview The vulnerability is a high-severity type confusion bug in V8's Maglev and...

CVE-2026-14431

CVE-2026-14431 Bug fix https://chromium-review.googlesource.com/c/v8/v8/+/7950517 maglev Check map of inlined array in ArrayIteratorPrototypeNext Fixed: 523884658 Change-Id: I2a2bba817952d7023eb4b97ad41d8bb460fb9359 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7950517...

CVE-2026-85046

CVE-2026-85046 V8 type confusion in inline Array.prototype.sort Maglev + Turbofan. Chrome 6th zero-day of 2026. Field| Value ---|--- CVSS| 8.8 High CWE| CWE-843 Type Confusion Component| V8 JavaScript Engine -- Maglev/Turbofan inline sort Affected| Chrome 152.0.7977.82, all Chromium-based browser...

CVE-2024-4947-PoC

CVE-2024-4947 — V8 Maglev Type Confusion → Full RCE d8 PoC A complete, self-contained exploitation chain for CVE-2024-4947 V8 Maglev type confusion, from the initial type-confusion trigger all the way to arbitrary code execution. The PoC runs against a non-sandboxed d8 build and prints...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Google Chrome

CVE-2026-85045 A training poc I cooked up while going after t...

Exploit for Type Confusion in Google Chrome

CVE-2024-4947 — V8 Maglev Type Confusion → Full RCE d8 PoC...

Chrome V8 Maglev Write Barrier Type Confusion RCE (CVE-2026-5865)

CVE-2026-5865 browser-side exploit for Google Chrome / Chromium V8 Maglev. Default chain: calibrated heap spray + addrof/fakeobj + WASM code-entry hijack set payload for shellcode. Alternate chain: Nebula JIT RWX exploitchain=nebulajit. Requires Chrome 130–146 pre-147.0.7727.55 and browserserver...

PT-2025-46575

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 142.0.7444.166 Chromium versions prior to 142.0.7444.162-1deb12u1 Debian bookworm Chromium versions prior to 142.0.7444.162-1deb13u1 Debian trixie Chromium versions prior to 142.0.7444.162-alt0.p11.1 Description...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the lack of limitation on max inlining ids ...

express-jwt (>=2.0.0, <=2.0.1), maglev (>=3.0.1, <=3.1.1) potentially affected by CVE-2015-9235 via jsonwebtoken (4.0.0)

jsonwebtoken NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jsonwebtoken and may be impacted: - express-jwt =2.0.0, =3.0.1, =3.1.1 Source cves: CVE-2015-9235 Source advisory: OSV:GHSA-C7HR-J4MJ-J2W6...

express-jwt (>=2.0.0, <=2.0.1), maglev (>=3.0.1, <=3.1.1) potentially affected by CVE-2015-9235 via jsonwebtoken (4.0.0)

jsonwebtoken NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jsonwebtoken and may be impacted: - express-jwt =2.0.0, =3.0.1, =3.1.1 Source cves: CVE-2015-9235 Source advisory: GHSA-C7HR-J4MJ-J2W6...