Type Confusion in Google Chrome Turbofan

Small standalone Python exploit repository centered on a single script, CVE-2026-6307.py, plus documentation and minimal packaging files. The Python script is the main entry point and implements a command-line PoC that can: (1) generate a malicious exploit.html page, (2) serve that page over a local HTTP server, and (3) emit a standalone JavaScript payload file. The exploit logic is browser-focused: it delivers crafted HTML/JavaScript intended to trigger a claimed Chrome V8 Turbofan type-confusion vulnerability by warming up a function for JIT optimization and then violating the optimizer’s type assumptions. The script also supports optional embedding of attacker-supplied shellcode, which is base64-encoded into the generated page. Repository structure is simple: one Python code file, one README with extensive vulnerability narrative and usage examples, a requirements.txt listing requests (though the visible code primarily uses Python standard-library modules), a license, and .gitignore. No external C/C++ exploit components, sandbox escape primitives, or OS-specific post-exploitation modules are present in the provided content. Based on the visible code, this is an operational PoC generator/host rather than a full exploit framework. It is not a detection script. The primary attack surface is browser/web delivery: a victim must open the generated local file or browse to the locally hosted page using a vulnerable Chrome version. The most fingerprintable operational artifacts are the generated file names (exploit.html, payload.js), optional shellcode input file, and the local HTTP service on port 8080.

Repository contains a real exploit PoC for CVE-2026-6307 ('Longinus'), a V8 TurboFan type-confusion bug involving JS-to-Wasm call inlining and incorrect FrameState merging. The main exploit is poc.js, which builds a WebAssembly module with mismatched externref/i64 return paths and uses V8 optimization/deoptimization intrinsics (%PrepareFunctionForOptimization and %OptimizeFunctionOnNextCall) to obtain two core exploitation primitives: addrof and fakeobj. The script then demonstrates object identity recovery and a conceptual ArrayBuffer-based arbitrary memory access path, but stops short of full renderer RCE or sandbox escape implementation. Repository structure: README.md documents the vulnerability, setup, and expected behavior; poc.js is the core exploit; gen.py is a Python generator that emits polymorphic/obfuscated JavaScript variants with anti-debug logic and labels for reverse_tcp/bind_tcp/stager modes, though these modes only print messages and do not implement real network shells; val.py is a validator that generates an obfuscated test payload and either runs it locally through d8 or POSTs it to a user-supplied remote execution endpoint to determine whether the target appears vulnerable; cve-2026-6307_d8_execution.yml is a Sigma-style detection rule for d8 execution with the required flags; cve-2026-6307_longinus_poc.yar is a YARA rule matching characteristic strings from the PoC. Capabilities: browser/web attack via malicious JavaScript against vulnerable Chrome/V8, local d8-based proof-of-concept execution, primitive generation for arbitrary address leak and fake object creation, obfuscated payload generation, and vulnerability validation. Notable endpoints are mostly references and local execution artifacts; the only dynamic network target is the arbitrary remote URL passed to val.py in remote mode, which receives JSON containing the generated script.

Repository is a real exploit research PoC for CVE-2026-6307, a V8 JS-to-Wasm type confusion affecting Chrome 146. It is not a framework module; it is a standalone lab repository with 13 files split into two main tracks: flag-free browser primitives and a deterministic no-ASLR renderer RCE demo. Structure: - README.md documents the vulnerability, tested versions, reliability, and execution steps. - flag-free/ contains four HTML PoCs that work without --allow-natives-syntax. These progressively demonstrate: (00) reachability of the confused deopt state, (01) addrof/fakeobj primitives, (02) a confused out-of-cage store landing in a chosen object field, and (03) in-cage arbitrary read/write via a forged PACKED_DOUBLE array. - rce-no-aslr/ contains two main exploit HTML files plus helper shell scripts. exploit-calc.html and exploit-exit.html use V8 natives syntax and a no-ASLR lab setup to convert the primitive into visible renderer RCE. run.sh automates local hosting and Chrome launch modes; demo.sh adds cleanup/retry logic; pocmode.sh switches the benign payload target; xcalc-msgbox.sh replaces xcalc with an xmessage banner. Main exploit capabilities: 1. Browser-side trigger of the vulnerable JS-to-Wasm deoptimization confusion. 2. Runtime address disclosure and object materialization primitives (addrof/fakeobj). 3. Arbitrary object field overwrite / confused store. 4. In-cage arbitrary 64-bit read/write by forging JSArray/FixedDoubleArray metadata. 5. JIT code patching in a deterministic lab environment. 6. Renderer code execution with benign shellcode payloads. The exploit is clearly intended for local reproduction and defensive research, but it is still operational exploit code. The RCE chain depends on weakened browser protections and deterministic addressing rather than being broadly weaponized. It serves exploit pages over a local Python HTTP server on 127.0.0.1:8080 and targets a locally launched vulnerable Chrome instance. The payloads are benign but genuine: execve('/usr/bin/xcalc'), exit(66), or an infinite jump loop for debugger validation.