Loading vulnerability…
CVE-2024-0519 is a high-severity out-of-bounds memory access vulnerability in the V8 JavaScript engine used by Google Chrome. According to the provided content, affected Chrome versions prior to 120.0.6099.224 can be triggered by a remote attacker via a crafted HTML page, leading to heap corruption. The content specifically describes the issue as an out-of-bounds memory access in V8 and notes it has been used in the wild, including as part of exploit chains involving a Chrome renderer bug and additional platform-level vulnerabilities.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a compact research/PoC set for V8 optimization bugs centered on CVE-2024-0519 and a related Chromium issue (chromium:325020448). It is not a weaponized exploit framework and does not deliver code execution; instead it provides reproducible artifacts for demonstrating incorrect compiler assumptions, stale constant folding, and engine integrity violations in vulnerable V8 builds. Repository structure: 2 Markdown docs (README.md, BUILD.md), 2 C++ cctest harnesses under harness/, 2 JavaScript triggers under js/, and 1 patch metadata note under patches/. BUILD.md explains how to fetch/build a vulnerable pre-patch V8 tree and integrate the harnesses into cctest. README.md maps each file to its purpose and gives quick-start commands. Main exploit capabilities: - harness/test-toctou-race.cc: a V8 cctest that attempts to reproduce the CVE-2024-0519 TOCTOU race window in GetOwnFastDataPropertyFromHeap during concurrent TurboFan compilation. It races property deletion against a reader thread and reports when one_pointer_filler_map is observed while the object map still matches the expected map. - harness/test-toctou-chain.cc: a deterministic end-to-end demonstration of the CVE consequence without relying on timing luck. It uses real V8 deletion behavior to clear a property slot, restores the old map pointer to synthesize the transient race state, then forces optimization so the compiler embeds filler as a HeapConstant. The resulting optimized JS reader() returns the filler-derived value. Additional probes test which JS operations survive versus abort under V8 checks. - js/poc_325020448.js: a standalone JavaScript PoC for a sibling V8 bug where PropertyConstness::kConst is incorrectly preserved across prototype transitions, allowing TurboFan to fold a stale HeapConstant. The observable result is incorrect logic: t1() returns 2 instead of the correct 3. - js/regress_325020448.js: the official regression-style test for the sibling bug using V8 natives syntax. Attack surface and targeting: the attack vector is local/browser-side against the V8 JavaScript engine. The code targets vulnerable V8/Chrome builds, especially V8 12.0.267.16 / Chrome 120 for CVE-2024-0519, and Chrome 122-123 for the sibling chromium:325020448 issue. There are no remote C2 endpoints, hardcoded IPs, or exfiltration paths. Extracted endpoints are primarily build/repository URLs and local file paths used for integrating and running the PoCs. Overall purpose: root-cause analysis and reproducibility. The repository documents the vulnerable behavior, the relevant fix commits, and provides both timing-sensitive and deterministic harnesses to validate the bug class and its consequences in V8’s optimization pipeline.
This repository provides a research-oriented proof-of-concept (PoC) environment for analyzing and demonstrating CVE-2024-0519, a critical out-of-bounds (OOB) memory access vulnerability in the Google Chrome V8 JavaScript engine. The structure consists of documentation (README.md, TESTING.md), a JavaScript file (src/exploit.js) that simulates the OOB exploit logic, and an HTML dashboard (src/index.html) that provides an interactive interface for triggering and visualizing the simulated exploit. The exploit.js file does not perform a real attack but simulates the steps of heap allocation and OOB read, logging simulated memory leaks to an on-page console. The index.html file provides buttons to trigger these actions and displays the results. The PoC is designed for educational and research purposes, allowing users to understand the vulnerability and its impact without risking actual exploitation or browser crashes. No real network or external endpoints are targeted; all actions occur within the browser context. The repository targets Chrome versions prior to 120.0 and V8 engine version 12.0, specifically demonstrating the bounds check bypass in the JIT optimization pipeline. The exploit is classified as a POC, as it does not deliver a real payload but effectively demonstrates the vulnerability's mechanics.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.