Loading story…
Researchers detailed how CVE-2023-3079 enabled remote code execution in the Chrome renderer through a type confusion flaw in the V8 JavaScript engine. The bug involved incorrect inline cache handling for property writes to JSStrictArgumentsObject, where the StoreFastElementIC_GrowNoTransitionHandleCOW handler could grow an elements backing store without changing the object from PACKED_ELEMENTS to HOLEY_ELEMENTS, creating an inconsistent internal state.
That inconsistency exposed V8’s internal "The Hole" value to JavaScript, which should remain inaccessible, and the leaked value was then used to trigger a Turbofan JIT type inference error that removed bounds checks. The resulting out-of-bounds array access gave attackers the primitives needed for addr_of and arbitrary read/write, forming the first stage of a broader exploit chain that later pursued sandbox escape and privilege escalation in Chrome.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Theori's writeup identifies CVE-2023-3079 as a Chrome renderer remote code execution vulnerability in the V8 JavaScript engine and describes it as an N-day used as the first stage of an exploit chain. The reference explicitly anchors the flaw to 2023 via its CVE identifier, but does not provide a more specific event date in the content.
Theori published a detailed blog post explaining how CVE-2023-3079 in V8 could be exploited to leak the internal 'The Hole' value, trigger a Turbofan type inference mistake, and achieve out-of-bounds access leading toward code execution. The post presents the bug as the first stage of a broader full-chain exploit demonstration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed exploitation of **`CVE-2020-6418`**, a type confusion flaw in Google Chrome’s V8 JavaScript engine that affects versions before **`80.0.3987.122`**. The bug lies in Turbofan’s handling of `JSCreate` within `InferMapsUnsafe`, where incorrect side-effect modeling can cause modified object Maps to be treated as trustworthy, skipping required Map checks and enabling out-of-bounds memory access. The write-up shows that a `Proxy` supplied through `Reflect.construct()` can trigger the condition and produce out-of-bounds read/write primitives inside the V8 sandbox. The research further demonstrates a practical exploitation path that avoids the common WebAssembly RWX approach by redirecting a JIT-compiled function’s `code_entry_point` to attacker-controlled immediate values already embedded in executable JIT code. The authors said they recreated the vulnerability in a newer V8 version using the original patch context and completed a demo exploit in `d8`, while a later reference highlights continued public interest in using AI assistance to develop Chrome exploit chains around browser vulnerabilities.
Jun 29, 2026
A flaw in Chrome's V8 JavaScript engine, tracked as **`CVE-2021-38003`**, exposed the internal **`TheHole`** value to attacker-controlled script code in Chromium-based browsers before **`95.0.4638.69`**. The bug stemmed from exception handling in **`JSON.stringify()`**, where an overflow path in `JsonStringifier::SerializeArrayLikeSlow()` could return an exception state without setting `pending_exception`, allowing later exception handling to retrieve an uninitialized value and leak `TheHole` into JavaScript. Researchers showed the leak could be turned into a full renderer compromise by abusing `TheHole` to corrupt a JavaScript `Map`'s state, gain out-of-bounds access, and build **addrof**, heap read/write, and arbitrary write primitives. The exploit chain then disabled Chromium's **wasm-memory-protection-keys** mitigation, wrote shellcode into a WebAssembly RWX page, and executed it to achieve renderer remote code execution. Google patched the issue by preventing fetches of an empty `pending_exception` and later added hardening to block `TheHole`-based `Map` deletion abuse; the vulnerability had also been reported as exploited in the wild.
Jun 29, 2026
Exodus Intelligence disclosed **CVE-2026-3542**, a Chrome vulnerability in V8’s AsmJS-to-WebAssembly pipeline that allowed attackers to break out of the **Ubercage** sandbox and achieve arbitrary code execution. The flaw stemmed from shared parser state used to track heap-access shift operations: nested shift expressions could overwrite truncation metadata, causing V8 to generate a stale, misaligned WebAssembly opcode stream. Because AsmJS-generated opcodes were treated as trusted, the malformed stream bypassed normal WebAssembly validation and enabled execution of unintended opcodes. The write-up shows how the bug could be turned into arbitrary read/write by abusing missing validation on cross-module type access for struct opcodes, leaking the trusted cage base through `WasmTrustedInstanceData`, and overwriting a WebAssembly jump table to seize control of execution. The research echoes earlier browser JIT exploitation work such as Google Project Zero’s analysis of **CVE-2020-9802** in WebKit JavaScriptCore, where compiler optimization errors also produced out-of-bounds access and exploit primitives despite modern mitigations. Google patched **CVE-2026-3542** in Chrome on 3 March 2026.
Jul 12, 2026