Loading vulnerability…
CVE-2025-2135 is a high-severity type confusion vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 134.0.6998.88. The flaw is rooted in TurboFan, V8’s optimizing JIT compiler, specifically in InferMapsUnsafe() map inference logic when processing TransitionElementsKindOrCheckMap nodes. Under certain aliasing conditions, the compiler can incorrectly treat inferred Maps as reliable even when two different IR nodes may reference the same HeapObject at runtime. This can cause optimized code to confuse array representations such as object arrays and double arrays, resulting in invalid type assumptions and heap corruption. A remote attacker can trigger the issue by causing a target to process a crafted HTML page containing malicious JavaScript. Public technical analysis indicates the bug can be developed into arbitrary read/write primitives within the V8 sandbox and used to achieve remote code execution in the browser renderer context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (POC) exploit for CVE-2025-2135, a vulnerability in Google's V8 JavaScript engine. The exploit is implemented in a single JavaScript file (poc-CVE-2025-2135.js) and is accompanied by a detailed README.md explaining the vulnerability and exploitation technique. The exploit leverages manipulation of large JavaScript arrays and V8's internal object layouts to create a 'fake' array object, which is then used to gain arbitrary address read and write capabilities within the V8 heap. This allows the attacker to read and write memory at arbitrary addresses, a powerful primitive for further exploitation. The exploit is designed for research and debugging purposes and requires a custom-built V8 engine at a specific commit, with certain flags enabled. There are no network or external endpoints; the attack vector is local, requiring the ability to execute JavaScript in the vulnerable V8 environment. The code demonstrates advanced exploitation techniques relevant to browser and JavaScript engine security research.
This repository contains a proof-of-concept exploit for CVE-2025-2135, targeting the V8 JavaScript engine (version 13.3.415.19) as used in Chromium-based browsers. The main file, exp.js, is a standalone exploit script designed to be run in the d8 shell with the --allow-natives-syntax flag. The exploit leverages advanced JavaScript engine internals, including JIT optimization and object structure manipulation, to achieve arbitrary memory read and write capabilities. It requires a helper.js file (not included) that provides the Helper class and related low-level primitives. The exploit demonstrates the ability to create fake objects, leak addresses, and manipulate memory, which can be used as a foundation for further exploitation such as sandbox escape or remote code execution. No network endpoints or external services are targeted; the attack vector is local, requiring the ability to execute JavaScript in the vulnerable engine context. The repository structure is minimal, consisting of a README and the main exploit script.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A prior Chrome Turbofan type confusion vulnerability referenced for historical comparison with similar root cause patterns in V8 JIT compilation.
A type-confusion vulnerability in Chrome’s V8 engine caused by missing alias checks in TurboFan’s InferMapsUnsafe() handling of TransitionElementsKindOrCheckMap, enabling remote code execution via arbitrary memory read/write within the V8 sandbox.
A critical Chromium type confusion issue (triggered via a crafted HTML page) that can cause heap corruption and impacts Kibana’s headless Chromium-based PDF/PNG reporting feature.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.