Loading story…
Researchers detailed exploitation of CVE-2020-6418, a type confusion flaw in Google Chrome’s V8 JavaScript engine that affects versions before 80.0.3987.122. The bug lies in Turbofan’s handling of JSCreate within InferMapsUnsafe, where incorrect side-effect modeling can cause modified object Maps to be treated as trustworthy, skipping required Map checks and enabling out-of-bounds memory access. The write-up shows that a Proxy supplied through Reflect.construct() can trigger the condition and produce out-of-bounds read/write primitives inside the V8 sandbox.
The research further demonstrates a practical exploitation path that avoids the common WebAssembly RWX approach by redirecting a JIT-compiled function’s code_entry_point to attacker-controlled immediate values already embedded in executable JIT code. The authors said they recreated the vulnerability in a newer V8 version using the original patch context and completed a demo exploit in d8, while a later reference highlights continued public interest in using AI assistance to develop Chrome exploit chains around browser vulnerabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
STAR Labs published a detailed write-up deconstructing CVE-2020-6418, explaining the root cause in V8's Turbofan compiler and showing how the flaw can be triggered via Proxy and Reflect.construct(). The article also demonstrated a working exploitation path to achieve out-of-bounds access and code execution primitives in a recreated environment.
Google addressed CVE-2020-6418, a type confusion vulnerability in Chrome's V8 JavaScript engine affecting versions prior to 80.0.3987.122. The STAR Labs analysis identifies the bug as fixed by the original patch context for Chrome 80.0.3987.122.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how `CVE-2023-3079` enabled remote code execution in the Chrome renderer through a type confusion flaw in the V8 JavaScript engine. The bug involved incorrect inline cache handling for property writes to `JSStrictArgumentsObject`, where the `StoreFastElementIC_GrowNoTransitionHandleCOW` handler could grow an elements backing store without changing the object from `PACKED_ELEMENTS` to `HOLEY_ELEMENTS`, creating an inconsistent internal state. That inconsistency exposed V8’s internal **"The Hole"** value to JavaScript, which should remain inaccessible, and the leaked value was then used to trigger a Turbofan JIT type inference error that removed bounds checks. The resulting out-of-bounds array access gave attackers the primitives needed for `addr_of` and arbitrary read/write, forming the first stage of a broader exploit chain that later pursued sandbox escape and privilege escalation in Chrome.
Jul 24, 2026
Exodus Intelligence disclosed **CVE-2026-3542**, a Chrome vulnerability in V8’s AsmJS-to-WebAssembly pipeline that allowed attackers to break out of the **Ubercage** sandbox and achieve arbitrary code execution. The flaw stemmed from shared parser state used to track heap-access shift operations: nested shift expressions could overwrite truncation metadata, causing V8 to generate a stale, misaligned WebAssembly opcode stream. Because AsmJS-generated opcodes were treated as trusted, the malformed stream bypassed normal WebAssembly validation and enabled execution of unintended opcodes. The write-up shows how the bug could be turned into arbitrary read/write by abusing missing validation on cross-module type access for struct opcodes, leaking the trusted cage base through `WasmTrustedInstanceData`, and overwriting a WebAssembly jump table to seize control of execution. The research echoes earlier browser JIT exploitation work such as Google Project Zero’s analysis of **CVE-2020-9802** in WebKit JavaScriptCore, where compiler optimization errors also produced out-of-bounds access and exploit primitives despite modern mitigations. Google patched **CVE-2026-3542** in Chrome on 3 March 2026.
Jul 12, 2026
Google has released security updates for Chrome to address several high-severity type confusion vulnerabilities in the V8 JavaScript engine, including CVE-2025-13223, CVE-2025-13224, CVE-2025-13226, CVE-2025-13228, CVE-2025-13229, and CVE-2025-13230. These vulnerabilities, present in Chrome versions prior to 142.0.7444.175/.176, allow remote attackers to exploit heap corruption via crafted HTML pages, potentially leading to arbitrary code execution or browser crashes. Notably, CVE-2025-13223 has been confirmed as actively exploited in the wild, prompting Google to issue an emergency update and restrict bug details until a majority of users are protected. Security researchers from Google's Threat Analysis Group and the AI agent Big Sleep were credited with discovering these flaws. Users are strongly advised to update Chrome to the latest stable versions (142.0.7444.175/.176 for Windows, 142.0.7444.176 for macOS, and 142.0.7444.175 for Linux) to mitigate the risk. Other Chromium-based browsers may also be affected and should be updated accordingly. No specific details about the attackers or targets have been disclosed, but the urgency of the update underscores the critical nature of these vulnerabilities.
Jul 23, 2026