Loading vulnerability…
CVE-2025-2135 is a high-severity type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. The flaw affects Chrome versions prior to 134.0.6998.88 and can be triggered when a target visits a crafted HTML page. Available technical analysis attributes the root cause to TurboFan, V8’s optimizing JIT compiler, specifically map inference logic in InferMapsUnsafe() when processing TransitionElementsKindOrCheckMap. Under aliasing conditions, the compiler can incorrectly treat inferred object maps as reliable and generate optimized code based on invalid type assumptions. This can cause confusion between array representations such as object arrays and double arrays, resulting in heap corruption. Researchers reported that the bug was exploitable for remote code execution and demonstrated exploitation primitives including arbitrary read and write within the V8 sandbox.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (POC) exploit for CVE-2025-2135, a vulnerability in Google's V8 JavaScript engine. The exploit is implemented in a single JavaScript file (poc-CVE-2025-2135.js) and is accompanied by a detailed README.md explaining the vulnerability and exploitation technique. The exploit leverages manipulation of large JavaScript arrays and V8's internal object layouts to create a 'fake' array object, which is then used to gain arbitrary address read and write capabilities within the V8 heap. This allows the attacker to read and write memory at arbitrary addresses, a powerful primitive for further exploitation. The exploit is designed for research and debugging purposes and requires a custom-built V8 engine at a specific commit, with certain flags enabled. There are no network or external endpoints; the attack vector is local, requiring the ability to execute JavaScript in the vulnerable V8 environment. The code demonstrates advanced exploitation techniques relevant to browser and JavaScript engine security research.
This repository contains a proof-of-concept exploit for CVE-2025-2135, targeting the V8 JavaScript engine (version 13.3.415.19) as used in Chromium-based browsers. The main file, exp.js, is a standalone exploit script designed to be run in the d8 shell with the --allow-natives-syntax flag. The exploit leverages advanced JavaScript engine internals, including JIT optimization and object structure manipulation, to achieve arbitrary memory read and write capabilities. It requires a helper.js file (not included) that provides the Helper class and related low-level primitives. The exploit demonstrates the ability to create fake objects, leak addresses, and manipulate memory, which can be used as a foundation for further exploitation such as sandbox escape or remote code execution. No network endpoints or external services are targeted; the attack vector is local, requiring the ability to execute JavaScript in the vulnerable engine context. The repository structure is minimal, consisting of a README and the main exploit script.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A prior Chrome Turbofan type confusion vulnerability referenced for historical comparison with similar root cause patterns in V8 JIT compilation.
A type-confusion vulnerability in Chrome’s V8 engine caused by missing alias checks in TurboFan’s InferMapsUnsafe() handling of TransitionElementsKindOrCheckMap, enabling remote code execution via arbitrary memory read/write within the V8 sandbox.
A critical Chromium type confusion issue (triggered via a crafted HTML page) that can cause heap corruption and impacts Kibana’s headless Chromium-based PDF/PNG reporting feature.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.