CVE-2026-85045

CVE-2026-85045 より大きなチェーンを追いかけている間に作ったトレーニング用のPoC。 Maglevは、再帰的な脱最適化フレームを実体化する際に、1つの可変なHeapNumberを再利用する。正確な上流のトリガーは、148ビルドと152.0.7977.75の両方で0,3,3,3を生成し、修正済みの152.0.7977.82では0,1,2,3となる。 poc.jsを--js-flags="--allow-natives-syntax --maglev"を付けてページスクリプトとして読み込む。...

CVE-2025-6554

CVE-2025-6554 脆弱性の再現 root@kitploit: for macOS: brew intsall ninja git clone https://chromium.googlesource.com/chromium/tools/depottools.git export PATH=/path/to/depottools:$PATH fetch v8 cd v8 git checkout 13.8.500258 gclient sync -D sh v8asan.sh autoninja -C out/arm64.asan d8...

CVE-2026-6307

CVE-2026-6307: V8 JS-to-Wasm 타입 혼동 → Chrome 146에서 RCE V8 JS-to-Wasm 디옵티마이제이션 타입 혼동 Nebula에 의해 설명됨의 로컬 재현 및 무기화로, Chrome for Testing 146.0.7680.165의 렌더러에서 xcalc를 실행합니다. 해당 버그는 147.0.7727.101에서 수정되었습니다. 모든 페이로드는 무해합니다 계산기 / exit0x42 / jmp $. 모든 것은 의도적으로 구버전 브라우저를 대상으로 로컬 연구실에서 실행되며, 다른 사람을 대상으로 삼지...

📄 V8 BytecodeArray Swapping Sandbox Bypass

V8 suffers from a sandbox bypass due to arbitrary bytecode execution from BytecodeArray swapping before code deoptimization. Vulnerability Details When deoptimizing compiled code and resuming execution in the interpreter, V8 uses the function Deoptimizer::DoComputeOutputFrames to reconstruct the...

SUSE CVE-2014-1721

Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimization, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by improper handling of a...

SUSE CVE-2016-1678

objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted JavaScript code...

Chrome V8 Turbofan Type Confusion

V8: Turbofan fails to deoptimize code after map deprecation, leading to type confusion NOTE: We have evidence that the following bug is being used in the wild. Therefore, this bug is subject to a 7 day disclosure deadline. VULNERABILITY DETAILS When turbofan compiles code that performs a Map...

SUSE SLED15 / SLES15 Security Update : java-11-openjdk (SUSE-SU-2020:2143-1)

This update for java-11-openjdk fixes the following issues : Update to upstream tag jdk-11.0.8+10 July 2020 CPU, bsc1174157 - Security fixes : + JDK-8230613: Better ASCII conversions + JDK-8231800: Better listing of arrays + JDK-8232014: Expand DTD support + JDK-8233234: Better Zip Naming +...

Spidermonkey - IonMonkey Unexpected ObjectGroup in ObjectGroupDispatch Operation

Spidermonkey - IonMonkey Unexpected ObjectGroup in ObjectGroupDispatch Operation While fuzzing Spidermonkey, I encountered the following commented and modified JavaScript program which crashes debug builds of the latest release version of Spidermonkey from commit...

Microsoft Edge Chakra - PathTypeHandlerBase::SetAttributesHelper Type Confusion

Microsoft Edge Chakra - PathTypeHandlerBase::SetAttributesHelper Type Confusion / Here's a snippet of PathTypeHandlerBase::SetAttributesHelper. PathTypeHandlerBase predTypeHandler = this; DynamicType currentType = instance-GetDynamicType; while predTypeHandler-GetPathLength propertyIndex...

CVE-2016-1678

objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted JavaScript code...

UBUNTU-CVE-2016-1678

objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted JavaScript code...

UBUNTU-CVE-2014-1721

Google V8, as used in Google Chrome before 34.0.1847.116, does not properly implement lazy deoptimization, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via crafted JavaScript code, as demonstrated by improper handling of a...