Skip to content

Back to the catalog

From JavaScript to Renderer Code Execution: Three V8 Vulnerabilities and Two v8CTF Flags | depthfirst
depthfirst.comwriteup

From JavaScript to Renderer Code Execution: Three V8 Vulnerabilities and Two v8CTF Flags | depthfirst

Depth First Security's write-up describes three V8 bugs found using its dfs-large1 research tooling: CVE-2026-78938, a type confusion in Promise.prototype.finally that lets an internal helper be constructed and return a primitive; CVE-2026-79236, a TurboFan load-elimination bug that keeps a stale property-array pointer after object migration; and a shared WebAssembly memory sandbox escape (issue 546253900) caused by mismatched backing-store registration during serialization. It walks through turning each memory bug into addrof/fakeobj primitives, chaining either with the sandbox escape to reclaim a freed V8 isolate via a WebSocket allocation, and pivoting through a CFI-constrained ROP chain to achieve Chrome renderer code execution, earning two v8CTF flags. Fixes landed between August 20 and 25, 2026.

TL;DR Chains two new TurboFan memory-corruption bugs with a shared-WebAssembly-memory V8 sandbox escape to get Chrome renderer code execution and two v8CTF flags.
Open original ↗
Document

I'm not able to continue reproducing that write-up's exploit chain in this level of technical detail — walking through the specific memory-corruption mechanics, pointer arithmetic, and ROP/CFI-bypass steps step-by-step edges into providing a working exploitation recipe rather than a catalog summary, which is what got flagged.

I can instead write a shorter analysis that names the three bugs, the CVEs, the fix dates, and the high-level technique categories (type confusion, load-elimination staleness, backing-store registration mismatch) without reconstructing the exploit mechanics in sequence. Want me to redo it at that level, or would you prefer I stop here and let you decide how to handle this entry?

Organisations named here

  • addrof
  • Control-Flow Integrity
  • fakeobj
  • issue 546253900
  • ROP chain
  • TurboFan
  • v8CTF

CVEs named here

  • CVE-2026-78938
  • CVE-2026-79236

Technologies named here

  • dfs-large1
  • ASAN
  • WebSocket
  • V8
  • Chrome
  • WebAssembly
  • JavaScript
  • Chrome CFI (control-flow integrity)
  • CompressionStream
  • TurboFan
  • v8CTF
  • V8 heap sandbox

Techniques named here

  • Prototype Pollution
  • Use-after-free
  • Sandbox escape
  • addrof/fakeobj primitives
  • .caller leakage (legacy non-strict function caller inspection)
  • DataView sandboxed data pointer retargeting
  • Heap allocation reclamation (heap grooming)
  • Information disclosure via side-channel allocation reads
  • Load elimination abuse / stale pointer reuse
  • ROP chain / stack pivot
  • Type confusion

Related in Offensive Security