Loading story…
Researchers found that Dota 2 shipped an outdated, unsandboxed build of Google’s V8 JavaScript engine, allowing attackers to achieve remote code execution through malicious JavaScript embedded in custom game modes. One Steam-published custom mode directly exploited CVE-2021-38003, a V8 flaw tied to a Chromium issue involving JSON.stringify, while three other malicious modes used a quieter backdoor that fetched and executed attacker-controlled JavaScript from a command-and-control server.
The malicious game modes were all published by the same author and targeted players who joined those custom matches, turning the game’s Panorama client-side JavaScript into a path across a security boundary and onto players’ systems. After disclosure, Valve upgraded V8, removed the malicious game modes from Steam, notified affected users, and added mitigations; the company said fewer than 200 players were impacted.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers inferred that a custom game mode later identified as malicious likely began as a legitimate mode and had malicious functionality added in March 2022. The modified mode embedded a JavaScript exploit for CVE-2021-38003 and included suspicious server-side Lua code.
A Chromium security bug describing a V8 issue involving JSON.stringify leaking TheHole value, leading to remote code execution, was published. This bug corresponds to CVE-2021-38003 later referenced in the Dota 2 exploitation chain.
On January 12, Valve upgraded Dota 2's V8 engine, removed the malicious custom game modes, notified affected players, and added mitigations. Valve said fewer than 200 players were affected.
Researchers discovered four Steam-published Dota 2 custom game modes by the same author that abused Dota 2's outdated, unsandboxed V8 engine. One directly embedded a CVE-2021-38003 exploit, while three others used a backdoor to fetch and execute arbitrary JavaScript from a command-and-control server.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed exploitation of **`CVE-2020-6418`**, a type confusion flaw in Google Chrome’s V8 JavaScript engine that affects versions before **`80.0.3987.122`**. The bug lies in Turbofan’s handling of `JSCreate` within `InferMapsUnsafe`, where incorrect side-effect modeling can cause modified object Maps to be treated as trustworthy, skipping required Map checks and enabling out-of-bounds memory access. The write-up shows that a `Proxy` supplied through `Reflect.construct()` can trigger the condition and produce out-of-bounds read/write primitives inside the V8 sandbox. The research further demonstrates a practical exploitation path that avoids the common WebAssembly RWX approach by redirecting a JIT-compiled function’s `code_entry_point` to attacker-controlled immediate values already embedded in executable JIT code. The authors said they recreated the vulnerability in a newer V8 version using the original patch context and completed a demo exploit in `d8`, while a later reference highlights continued public interest in using AI assistance to develop Chrome exploit chains around browser vulnerabilities.
Jun 29, 2026
Researchers disclosed a remote code execution chain against **Discord Desktop** that combined a cross-site scripting flaw in Discord embeds, a Chromium content security policy bypass, and a **V8** engine vulnerability to achieve code execution on the client. The attack began with XSS in a **Vimeo embed** rendered inside Discord, then used an older Chromium CSP bypass to load attacker-controlled content despite Vimeo’s restrictive policy. The write-up says Discord Desktop was running **Electron 9** with **Chromium 83**, with `nodeIntegration` disabled and `contextIsolation` enabled, but without an explicit `sandbox=true` setting on the main window. The researchers then abused Discord’s handling of the `new-window` event and redirect behavior to obtain an **unsandboxed renderer**, creating the conditions needed to exploit a known V8 issue tracked as **Chromium bug `1196683`** and reach code execution. The report credits collaboration with Harsh Jaiswal and ptrYudai, and links the exploit chain to a V8 code review reference associated with the underlying browser-engine bug. Discord later mitigated the issue by upgrading Electron and fixing the new-window configuration so external sites could no longer load in unsafe new windows.
Jul 23, 2026
Google released Chrome fixes for multiple high-severity vulnerabilities in the V8 JavaScript engine, including `CVE-2025-10891`, `CVE-2025-10892`, and `CVE-2025-9864`, that could be triggered when a user visits a malicious web page. The flaws include integer overflows and a use-after-free condition that can cause heap corruption in the browser renderer and potentially lead to arbitrary code execution. A related bulletin also lists `CVE-2025-10890`, a V8 side-channel information disclosure issue, alongside the two integer overflow bugs, warning that successful exploitation could expose sensitive data or enable full system compromise. Google said the affected Chrome builds were patched across Windows, macOS, and Linux in the `140.0.7339` release line, with fixes landing in versions including `140.0.7339.80/.81` and later `140.0.7339.207/.208` depending on the flaw and platform. Several of the vulnerabilities were reportedly identified by Google’s AI-based Big Sleep system, and no public proof-of-concept exploits were cited in the referenced reports. Organizations using Chrome or Chromium-based browsers were urged to deploy the vendor updates promptly because the bugs are reachable through routine web browsing and may also affect downstream browsers that have not yet incorporated the upstream patches.
Jun 29, 2026