external_v8_AOSP10_r33_CVE-2021-0393

V8 JavaScript Engine V8 is Google's open source JavaScript engine. V8 implements ECMAScript as specified in ECMA-262. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 can run standalone, or can be embedded into any C++ application. V8 Project page:...

CVE-2026-6307

CVE-2026-6307: V8 JS-to-Wasm type confusion → RCE on Chrome 146 Local reproduction and weaponization of the V8 JS-to-Wasm deoptimization type confusion described by Nebula, taken to a xcalc popped from the renderer of Chrome for Testing 146.0.7680.165 the bug is fixed in 147.0.7727.101. All...

CVE-2026-11645

CVE-2026-11645 - V8 in Google Chrome prior to Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-06-09 Technical Summary Out...

exploitgym

ExploitGym ExploitGym is a large-scale, realistic benchmark built from real-world vulnerabilities across userspace programs, Google's V8 engine, and the Linux kernel, designed to evaluate AI agents' ability to develop exploits. Quick start 1. Python deps uv sync --extra proxy 2. Build runtime...

javascript-obfuscator

JavaScript obfuscator 🚀 Obfuscator.io with VM Obfuscation Obfuscator.io adds VM-based bytecode obfuscation to this package - your JavaScript functions are compiled to custom bytecode that runs on an embedded virtual machine. Each build produces unique opcodes and VM structure, making reverse...

CVE-2026-118318

Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-118316

Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-118320

Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-118359

Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2024-7965

CVE-2024-7965 This repository contains PoC for CVE-2024-7965. This is the vulnerability in the V8 that occurs only within ARM64. Acknowledgments Yuri Pazdnikov — Junior Vulnerability Researcher @ BI.ZONE...

TFC-Chrome-v8-bug-CVE-2021-38001-poc

TFC-Chrome-v8-bug-CVE-2021-38001-poc run d8 with commdline: ./d8 2.mjs...

exploits

exploits CVE-2021-22600: Linux kernel LPE exploit CVE-2021-3156: Linux local privilege escalation through heap overflow in sudo Demo CVE-2021-3156: One shot exploit for heap overflow vulnerability in sudo CVE-2020-6507: Out of bounds write in V8. Chrome versions = 83.0.4103.97. RCE CVE-2020-16040...

jscd

jscd Reverse bytenode-compiled .jsc files back to JavaScript. Static parsing only: one pure-Rust binary — no patched V8, no Node runtime, no network. Supports Node 8.0.0 → 26.12.1 517 releases / 36 V8 minors and Electron 11 and 19 → 45 V8 8.7 – 15.6, pointer-compressed and sandboxed builds...

CVE-2023-3079

Exploit for CVE-2023-3079 Shoutout to @clem1 for finding the ITW exploit. Shoutout to @alisaesage for her prior RCA on the bug. Shoutout to @buptsb for his notes on the bug. Resources Writeups and other resources. https://issues.chromium.org/issues/40065138...

CVE-2024-12381

CVE-2024-12381 CVE-2024-12381 is a WebAssembly type canonicalization vulnerability in Chrome's V8 engine where CanonicalEquality::EqualValueType fails to account for nullability in indexed reference types. Combined with a JSPI-based V8 sandbox bypass CVE-2024-12692, this allows remote code...

View8

View8 View8 is a static analysis tool designed to decompile serialized V8 bytecode objects JSC files into high-level readable code. To parse and disassemble these serialized objects, View8 utilizes a patched compiled V8 binary. As a result, View8 produces a textual output similar to JavaScript...

Vulnerability_PoC

The PoC/Exploit of some interesting vulnerabilities Author: Vulnerability Research Team of Numen Cyber Labs 1. TCP/IP RCE Vulnerability CVE-2022–34718 PoC Restoration and Analysis...

CVE-2025-6554

CVE-2025-6554 Proof of Concept ⚠️ Security Research Project - This project is intended solely for security research and educational purposes. Do not use in production environments. 📋 Project Overview CVE-2025-6554 is a critical vulnerability in the Chrome V8 engine, involving the "Temporal Dead...

CVE-2021-21220

Exploitation of CVE-2021-21220 From Incorrect JIT Behavior to Remote Code Execution Overview This presentation explains the exploitation of CVE-2021-21220 , a vulnerability in Google Chrome’s V8 JavaScript engine caused by incorrect JIT compiler assumptions during optimization. The presentation...

CVE-2021-30632

CVE-2021-30632 Chrome V8 RCE Exploit for Windows Tested Version : Chrome 91, 92, 93.0.4577.63 Demo reference Chrome in-the-wild bug analysis: CVE-2021-30632 https://securitylab.github.com/research/inthewildchromecve202130632/ JS POC sample...