DEVOURED
I had some free time, so I tried to pwn V8
A security researcher successfully chained three public V8 vulnerabilities to gain arbitrary code execution and retrieve the flag from Google's v8CTF challenge.
What: Himanshu Anand chained a compiler bug (address oracle), a RegExp garbage collection flaw (fake array creation), and a JSPI/JDT mismatch (stack pointer pivot) to escape the V8 sandbox and execute a ROP chain inside the Chrome renderer.
Why it matters: This demonstrates how modern browser exploitation requires chaining multiple narrow primitives—leaking addresses, corrupting metadata, and pivoting stacks—rather than relying on a single 'magic' exploit.
Deep dive
- The exploit targeted Chrome 150.0.7871.46 for the v8CTF environment.
- Bug 1 (CVE-2026-15903) allowed an out-of-bounds read to leak object addresses.
- Bug 2 (CVE-2026-15776) exploited incorrect garbage collection bookkeeping to create a fake JS array.
- Bug 3 (Chromium 537948358) used a JSPI/JDT mismatch to gain control over the native stack.
- The final ROP chain reused existing binary code to perform 'open', 'read', and 'write' (ORW) operations.
- Reliability remained low due to heap volatility and garbage collection timing.
- LLMs assisted in source code navigation and harness development but could not generate the exploit automatically.
Decoder
- V8 Cage: A 4GB virtual memory address space used by V8 to store objects, which limits the impact of pointer corruption.
- ROP (Return-Oriented Programming): An exploit technique where an attacker chains together short snippets of existing executable code, called 'gadgets', to achieve arbitrary execution without injecting new shellcode.
- JSPI (JavaScript Promise Integration): A feature allowing WebAssembly to pause execution and resume asynchronously, which created a native stack state that could be corrupted.
- JDT (JS Dispatch Table): A data structure used by V8 to manage function calls; mismatches here allow for malicious control flow redirection.
Original article
Full article content is not available for inline reading.
Explore all 59 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi