Loading vulnerability…
CVE-2024-0519 is a high-severity out-of-bounds memory access vulnerability in the V8 JavaScript engine used by Google Chrome. It affects Chrome versions prior to 120.0.6099.224. The flaw can be triggered by a remote attacker through a crafted HTML page, causing out-of-bounds access and resulting heap memory corruption in the browser process. Available reporting indicates the issue has been exploited in the wild as a zero-day. The memory corruption condition may expose memory contents and can be leveraged as part of a broader exploitation chain to progress toward remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a compact research/PoC set for V8 optimization bugs centered on CVE-2024-0519 and a related Chromium issue (chromium:325020448). It is not a weaponized exploit framework and does not deliver code execution; instead it provides reproducible artifacts for demonstrating incorrect compiler assumptions, stale constant folding, and engine integrity violations in vulnerable V8 builds. Repository structure: 2 Markdown docs (README.md, BUILD.md), 2 C++ cctest harnesses under harness/, 2 JavaScript triggers under js/, and 1 patch metadata note under patches/. BUILD.md explains how to fetch/build a vulnerable pre-patch V8 tree and integrate the harnesses into cctest. README.md maps each file to its purpose and gives quick-start commands. Main exploit capabilities: - harness/test-toctou-race.cc: a V8 cctest that attempts to reproduce the CVE-2024-0519 TOCTOU race window in GetOwnFastDataPropertyFromHeap during concurrent TurboFan compilation. It races property deletion against a reader thread and reports when one_pointer_filler_map is observed while the object map still matches the expected map. - harness/test-toctou-chain.cc: a deterministic end-to-end demonstration of the CVE consequence without relying on timing luck. It uses real V8 deletion behavior to clear a property slot, restores the old map pointer to synthesize the transient race state, then forces optimization so the compiler embeds filler as a HeapConstant. The resulting optimized JS reader() returns the filler-derived value. Additional probes test which JS operations survive versus abort under V8 checks. - js/poc_325020448.js: a standalone JavaScript PoC for a sibling V8 bug where PropertyConstness::kConst is incorrectly preserved across prototype transitions, allowing TurboFan to fold a stale HeapConstant. The observable result is incorrect logic: t1() returns 2 instead of the correct 3. - js/regress_325020448.js: the official regression-style test for the sibling bug using V8 natives syntax. Attack surface and targeting: the attack vector is local/browser-side against the V8 JavaScript engine. The code targets vulnerable V8/Chrome builds, especially V8 12.0.267.16 / Chrome 120 for CVE-2024-0519, and Chrome 122-123 for the sibling chromium:325020448 issue. There are no remote C2 endpoints, hardcoded IPs, or exfiltration paths. Extracted endpoints are primarily build/repository URLs and local file paths used for integrating and running the PoCs. Overall purpose: root-cause analysis and reproducibility. The repository documents the vulnerable behavior, the relevant fix commits, and provides both timing-sensitive and deterministic harnesses to validate the bug class and its consequences in V8’s optimization pipeline.
This repository provides a research-oriented proof-of-concept (PoC) environment for analyzing and demonstrating CVE-2024-0519, a critical out-of-bounds (OOB) memory access vulnerability in the Google Chrome V8 JavaScript engine. The structure consists of documentation (README.md, TESTING.md), a JavaScript file (src/exploit.js) that simulates the OOB exploit logic, and an HTML dashboard (src/index.html) that provides an interactive interface for triggering and visualizing the simulated exploit. The exploit.js file does not perform a real attack but simulates the steps of heap allocation and OOB read, logging simulated memory leaks to an on-page console. The index.html file provides buttons to trigger these actions and displays the results. The PoC is designed for educational and research purposes, allowing users to understand the vulnerability and its impact without risking actual exploitation or browser crashes. No real network or external endpoints are targeted; all actions occur within the browser context. The repository targets Chrome versions prior to 120.0 and V8 engine version 12.0, specifically demonstrating the bounds check bypass in the JIT optimization pipeline. The exploit is classified as a POC, as it does not deliver a real payload but effectively demonstrates the vulnerability's mechanics.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Chrome zero-day vulnerability referenced as having been exploited in attacks, though no technical details are provided in the content.
A critical zero-day out-of-bounds memory access vulnerability in the V8 component of Google Chrome that can lead to remote code execution and denial of service.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.