Loading vulnerability…
CVE-2023-2033 is a high-severity type confusion vulnerability in the V8 JavaScript engine in Google Chrome prior to 112.0.5615.121. A remote attacker can trigger the flaw by causing Chrome to process a crafted HTML page, leading to heap corruption within V8. Available reporting also associates in-the-wild exploitation of this bug with obtaining typical V8 exploitation primitives such as address disclosure and arbitrary read/write within the V8 heap. Successful exploitation of the underlying memory corruption can form the basis for further exploitation, including chaining with a V8 sandbox escape or bypass to reach native code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a proof-of-concept exploit for CVE-2023-2033, a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. The main file, 'exploit.js', is a standalone JavaScript exploit that must be run in a specifically built version of the V8 d8 shell (commit f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c). The exploit leverages a bug in V8's Turbofan JIT compiler's type system, allowing the attacker to create arbitrary memory read and write primitives by manipulating JavaScript arrays and objects. The exploit demonstrates the ability to leak addresses and craft fake objects, which are essential steps toward achieving arbitrary code execution. The repository also includes a patch file, 'fix_torque_build_error.patch', which is only needed to resolve a build issue in V8 and is not related to the vulnerability. The README is minimal and simply identifies the CVE. No network endpoints or external services are targeted; the exploit is purely local and requires manual setup of the vulnerable environment.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A use-after-free vulnerability in V8 JavaScript engine in Google Chrome, exploited by Predator spyware.
An in-the-wild V8 vulnerability that provides initial exploitation primitives inside the V8 heap, but requires a separate V8 sandbox escape to achieve full code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.