Type Confusion in Google Chrome Turbofan

Repository contains a real exploit PoC for CVE-2026-6307 ('Longinus'), a V8 TurboFan type-confusion bug involving JS-to-Wasm call inlining and incorrect FrameState merging. The main exploit is poc.js, which builds a WebAssembly module with mismatched externref/i64 return paths and uses V8 optimization/deoptimization intrinsics (%PrepareFunctionForOptimization and %OptimizeFunctionOnNextCall) to obtain two core exploitation primitives: addrof and fakeobj. The script then demonstrates object identity recovery and a conceptual ArrayBuffer-based arbitrary memory access path, but stops short of full renderer RCE or sandbox escape implementation. Repository structure: README.md documents the vulnerability, setup, and expected behavior; poc.js is the core exploit; gen.py is a Python generator that emits polymorphic/obfuscated JavaScript variants with anti-debug logic and labels for reverse_tcp/bind_tcp/stager modes, though these modes only print messages and do not implement real network shells; val.py is a validator that generates an obfuscated test payload and either runs it locally through d8 or POSTs it to a user-supplied remote execution endpoint to determine whether the target appears vulnerable; cve-2026-6307_d8_execution.yml is a Sigma-style detection rule for d8 execution with the required flags; cve-2026-6307_longinus_poc.yar is a YARA rule matching characteristic strings from the PoC. Capabilities: browser/web attack via malicious JavaScript against vulnerable Chrome/V8, local d8-based proof-of-concept execution, primitive generation for arbitrary address leak and fake object creation, obfuscated payload generation, and vulnerability validation. Notable endpoints are mostly references and local execution artifacts; the only dynamic network target is the arbitrary remote URL passed to val.py in remote mode, which receives JSON containing the generated script.

Repository is a real exploit research PoC for CVE-2026-6307, a V8 JS-to-Wasm type confusion affecting Chrome 146. It is not a framework module; it is a standalone lab repository with 13 files split into two main tracks: flag-free browser primitives and a deterministic no-ASLR renderer RCE demo. Structure: - README.md documents the vulnerability, tested versions, reliability, and execution steps. - flag-free/ contains four HTML PoCs that work without --allow-natives-syntax. These progressively demonstrate: (00) reachability of the confused deopt state, (01) addrof/fakeobj primitives, (02) a confused out-of-cage store landing in a chosen object field, and (03) in-cage arbitrary read/write via a forged PACKED_DOUBLE array. - rce-no-aslr/ contains two main exploit HTML files plus helper shell scripts. exploit-calc.html and exploit-exit.html use V8 natives syntax and a no-ASLR lab setup to convert the primitive into visible renderer RCE. run.sh automates local hosting and Chrome launch modes; demo.sh adds cleanup/retry logic; pocmode.sh switches the benign payload target; xcalc-msgbox.sh replaces xcalc with an xmessage banner. Main exploit capabilities: 1. Browser-side trigger of the vulnerable JS-to-Wasm deoptimization confusion. 2. Runtime address disclosure and object materialization primitives (addrof/fakeobj). 3. Arbitrary object field overwrite / confused store. 4. In-cage arbitrary 64-bit read/write by forging JSArray/FixedDoubleArray metadata. 5. JIT code patching in a deterministic lab environment. 6. Renderer code execution with benign shellcode payloads. The exploit is clearly intended for local reproduction and defensive research, but it is still operational exploit code. The RCE chain depends on weakened browser protections and deterministic addressing rather than being broadly weaponized. It serves exploit pages over a local Python HTTP server on 127.0.0.1:8080 and targets a locally launched vulnerable Chrome instance. The payloads are benign but genuine: execve('/usr/bin/xcalc'), exit(66), or an infinite jump loop for debugger validation.