Loading story…
A flaw in Chrome's V8 JavaScript engine, tracked as CVE-2021-38003, exposed the internal TheHole value to attacker-controlled script code in Chromium-based browsers before 95.0.4638.69. The bug stemmed from exception handling in JSON.stringify(), where an overflow path in JsonStringifier::SerializeArrayLikeSlow() could return an exception state without setting pending_exception, allowing later exception handling to retrieve an uninitialized value and leak TheHole into JavaScript.
Researchers showed the leak could be turned into a full renderer compromise by abusing TheHole to corrupt a JavaScript Map's state, gain out-of-bounds access, and build addrof, heap read/write, and arbitrary write primitives. The exploit chain then disabled Chromium's wasm-memory-protection-keys mitigation, wrote shellcode into a WebAssembly RWX page, and executed it to achieve renderer remote code execution. Google patched the issue by preventing fetches of an empty pending_exception and later added hardening to block TheHole-based Map deletion abuse; the vulnerability had also been reported as exploited in the wild.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
STAR Labs published a detailed write-up showing how the JSON.stringify() exception-handling flaw could leak TheHole, corrupt JSMap state, achieve out-of-bounds access, and ultimately gain arbitrary write and renderer RCE in Chromium-based browsers. The post also described bypassing the wasm-memory-protection-keys mitigation and executing shellcode from a WASM RWX page.
After the initial fix, Google introduced an additional safeguard to prevent TheHole from being used as a key in Map deletion abuse, blocking a technique described in exploitation of the bug. This was a defense-in-depth hardening change beyond the original patch.
The bug report associated with CVE-2021-38003 was made public in February 2022, exposing additional technical details about the flaw. This followed the earlier disclosure and patching of the issue.
The vulnerability was reported as having been used in real-world attacks at the time of disclosure. This established the bug as more than a theoretical issue and raised its severity.
CVE-2021-38003, a V8 vulnerability that could leak the internal TheHole value and enable renderer remote code execution, was disclosed in October 2021. Google fixed affected Chrome versions before 95.0.4638.69 by preventing V8 from fetching an unset pending exception.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how `CVE-2023-3079` enabled remote code execution in the Chrome renderer through a type confusion flaw in the V8 JavaScript engine. The bug involved incorrect inline cache handling for property writes to `JSStrictArgumentsObject`, where the `StoreFastElementIC_GrowNoTransitionHandleCOW` handler could grow an elements backing store without changing the object from `PACKED_ELEMENTS` to `HOLEY_ELEMENTS`, creating an inconsistent internal state. That inconsistency exposed V8’s internal **"The Hole"** value to JavaScript, which should remain inaccessible, and the leaked value was then used to trigger a Turbofan JIT type inference error that removed bounds checks. The resulting out-of-bounds array access gave attackers the primitives needed for `addr_of` and arbitrary read/write, forming the first stage of a broader exploit chain that later pursued sandbox escape and privilege escalation in Chrome.
Jul 24, 2026
Researchers detailed exploitation of **`CVE-2020-6418`**, a type confusion flaw in Google Chrome’s V8 JavaScript engine that affects versions before **`80.0.3987.122`**. The bug lies in Turbofan’s handling of `JSCreate` within `InferMapsUnsafe`, where incorrect side-effect modeling can cause modified object Maps to be treated as trustworthy, skipping required Map checks and enabling out-of-bounds memory access. The write-up shows that a `Proxy` supplied through `Reflect.construct()` can trigger the condition and produce out-of-bounds read/write primitives inside the V8 sandbox. The research further demonstrates a practical exploitation path that avoids the common WebAssembly RWX approach by redirecting a JIT-compiled function’s `code_entry_point` to attacker-controlled immediate values already embedded in executable JIT code. The authors said they recreated the vulnerability in a newer V8 version using the original patch context and completed a demo exploit in `d8`, while a later reference highlights continued public interest in using AI assistance to develop Chrome exploit chains around browser vulnerabilities.
Jun 29, 2026
Exodus Intelligence disclosed **CVE-2026-3542**, a Chrome vulnerability in V8’s AsmJS-to-WebAssembly pipeline that allowed attackers to break out of the **Ubercage** sandbox and achieve arbitrary code execution. The flaw stemmed from shared parser state used to track heap-access shift operations: nested shift expressions could overwrite truncation metadata, causing V8 to generate a stale, misaligned WebAssembly opcode stream. Because AsmJS-generated opcodes were treated as trusted, the malformed stream bypassed normal WebAssembly validation and enabled execution of unintended opcodes. The write-up shows how the bug could be turned into arbitrary read/write by abusing missing validation on cross-module type access for struct opcodes, leaking the trusted cage base through `WasmTrustedInstanceData`, and overwriting a WebAssembly jump table to seize control of execution. The research echoes earlier browser JIT exploitation work such as Google Project Zero’s analysis of **CVE-2020-9802** in WebKit JavaScriptCore, where compiler optimization errors also produced out-of-bounds access and exploit primitives despite modern mitigations. Google patched **CVE-2026-3542** in Chrome on 3 March 2026.
Jul 12, 2026