Loading story…
Google fixed CVE-2026-95342, a V8 cross-security-token capability-disclosure vulnerability in Error.captureStackTrace. A trusted JavaScript realm could capture a stack trace on an object originating in an untrusted realm; when that realm read .stack, its Error.prepareStackTrace callback could receive retained trusted stack frames. The attacker could then use CallSite.prototype.getFunction() to retrieve and invoke a function from the trusted realm, bypassing intended security-token isolation.
The issue was reproducible in standalone V8 d8 15.3.0 candidate builds and could expose a trusted secret even where direct cross-token global access was denied. V8 addressed the flaw by adding security-token checks to CallSite getters, expanding the remediation from key getters to all 19 CallSitePrototype* getters and WebAssembly-frame handling; release notes were targeted for Chromium M154.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
The release-note target for CVE-2026-95342 was updated to 0-M154.
The V8 vulnerability was assigned CVE-2026-95342.
V8 marked the cross-security-token CallSite capability-disclosure vulnerability fixed.
A follow-up V8 change extended security-token protections to all 19 CallSitePrototype getters and Wasm frames, returning filtered values when tokens do not match.
V8 committed an initial fix that checks security-token compatibility before exposing function or receiver values through CallSite getters, filtering incompatible values such as getFunction() and getThis().
V8 accepted the report of a cross-security-token capability-disclosure flaw in CallSite stack-trace getters and classified it as severity S3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Exodus Intelligence disclosed **CVE-2026-3542**, a Chrome vulnerability in V8’s AsmJS-to-WebAssembly pipeline that allowed attackers to break out of the **Ubercage** sandbox and achieve arbitrary code execution. The flaw stemmed from shared parser state used to track heap-access shift operations: nested shift expressions could overwrite truncation metadata, causing V8 to generate a stale, misaligned WebAssembly opcode stream. Because AsmJS-generated opcodes were treated as trusted, the malformed stream bypassed normal WebAssembly validation and enabled execution of unintended opcodes. The write-up shows how the bug could be turned into arbitrary read/write by abusing missing validation on cross-module type access for struct opcodes, leaking the trusted cage base through `WasmTrustedInstanceData`, and overwriting a WebAssembly jump table to seize control of execution. The research echoes earlier browser JIT exploitation work such as Google Project Zero’s analysis of **CVE-2020-9802** in WebKit JavaScriptCore, where compiler optimization errors also produced out-of-bounds access and exploit primitives despite modern mitigations. Google patched **CVE-2026-3542** in Chrome on 3 March 2026.
Jul 12, 2026
Researchers detailed exploitation of **`CVE-2020-6418`**, a type confusion flaw in Google Chrome’s V8 JavaScript engine that affects versions before **`80.0.3987.122`**. The bug lies in Turbofan’s handling of `JSCreate` within `InferMapsUnsafe`, where incorrect side-effect modeling can cause modified object Maps to be treated as trustworthy, skipping required Map checks and enabling out-of-bounds memory access. The write-up shows that a `Proxy` supplied through `Reflect.construct()` can trigger the condition and produce out-of-bounds read/write primitives inside the V8 sandbox. The research further demonstrates a practical exploitation path that avoids the common WebAssembly RWX approach by redirecting a JIT-compiled function’s `code_entry_point` to attacker-controlled immediate values already embedded in executable JIT code. The authors said they recreated the vulnerability in a newer V8 version using the original patch context and completed a demo exploit in `d8`, while a later reference highlights continued public interest in using AI assistance to develop Chrome exploit chains around browser vulnerabilities.
Jun 29, 2026
Researchers detailed how `CVE-2023-3079` enabled remote code execution in the Chrome renderer through a type confusion flaw in the V8 JavaScript engine. The bug involved incorrect inline cache handling for property writes to `JSStrictArgumentsObject`, where the `StoreFastElementIC_GrowNoTransitionHandleCOW` handler could grow an elements backing store without changing the object from `PACKED_ELEMENTS` to `HOLEY_ELEMENTS`, creating an inconsistent internal state. That inconsistency exposed V8’s internal **"The Hole"** value to JavaScript, which should remain inaccessible, and the leaked value was then used to trigger a Turbofan JIT type inference error that removed bounds checks. The resulting out-of-bounds array access gave attackers the primitives needed for `addr_of` and arbitrary read/write, forming the first stage of a broader exploit chain that later pursued sandbox escape and privilege escalation in Chrome.
Jul 24, 2026