Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8 sandbox bypass to achieve renderer RCE and sandbox escape in Chrome/Chromium.

SKILL: Browser / V8 Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION : Expert V8/Chrome exploitation techniques. Covers V8 compilation pipeline, JIT type confusion, addrof/fakeobj primitives, ArrayBuffer corruption, WASM RWX pages, V8 sandbox (pointer compression), and Chrome sandbox escape overview. Distilled from ctf wiki browser sections, Project Zero research, and CTF competition patterns. Base models often confuse V8 object representation details and miss the pointer compression barrier. 0. RELATED ROUTING [sandbox escape techniques](../sandbox escape techniques/SKILL.md) — Chrome renderer sandbox escape via IPC/Mojo [heap exploitation](../heap exploitation/SKILL.md) — general heap concepts applicable to V8 heap [stack overflow and rop](../stack overflow and rop/SKILL.md) — ROP concepts for native code execution after V8 escape [binary protection bypass](../binary protection bypass/SKILL.md) — ASLR/NX bypass in browser context Advanced Reference Load [V8 EXPLOITATION PATTERNS.md](./V8 EXPLOITATION PATTERNS.md) when you need: Detailed exploitation patterns and code templates Heap layout manipulation and GC interaction V8 sandbox bypass techniques Object map confusion patterns 1. V8 ARCHITECTURE Compilation Pipeline Key V8 Concepts Concept Description Tagged pointers SMI (Small Integer): value << 1 , HeapObject: ptr \ 1 Pointer compression V8 ≥ 8.0: objects addressed via 32 bit offset from cage base (4GB sandbox) Maps (Hidden Classes) Define object shape: property names, types, offsets Elements kinds Internal array type: PACKED SMI ELEMENTS , PACKED DOUBLE ELEMENTS , PACKED ELEMENTS , etc. Write barrier GC bookkeeping when heap pointers are written Garbage collection Orinoco GC: minor (Scavenge) and major (Mark Compact) Object Representation (64 bit, pointer compression) 2. COMMON V8 BUG CLASSES Bug Class Description Example JIT Type Confusion TurboFan assumes wrong type after optimization Speculative type guard eliminated, wrong operation applied Incorrect Bounds Elimination JIT removes array bounds check based on wrong range analysis CheckBounds node eliminated → OOB access Prototype Chain Confusion Optimization assumes stable prototype, mutations invalidate Prototype change after optimization → wrong property access Turbofan Reduction Bug Incorrect strength reduction or constant folding Integer overflow in range analysis Race Condition SharedArrayBuffer + worker thread race Type confusion via concurrent modification Off by one in Builtin Boundary error in built in function implementation String/Array bounds Typer Bug Incorrect type range computation in TurboFan Typer says value is in [0, N] but can be N+1 Triggering JIT Optimization 3. EXPLOITATION PRIMITIVES addrof — Leak Object Address fakeobj — Create Fake Object Reference Building Arbitrary R/W from addrof + fakeobj 4. OOB READ/WRITE VIA CONFUSED ARRAY BOUNDS When TurboFan incorrectly eliminates bounds checks: What's Adjacent in V8 Heap? Objects are allocated sequentially in V8's young generation (new space). By controlling allocation order: 5. ARRAYBUFFER ARBITRARY R/W ArrayBuffer 's backing store is a raw pointer to allocated memory. Corrupting it gives absolute memory R/W. V8 Sandbox (Pointer Compression) Impact Since V8 ≥ 8.0 (pointer compression) and V8 sandbox (≥ 11.x): ArrayBuffer.backing store is a sandbox pointer (within the V8 cage, 4GB region) Cannot directly point outside the V8 cage Need sandbox escape to get full process memory access 6. WASM RWX PAGE WebAssembly JIT code is placed on RWX (Read Write Execute) pages on some platforms. Modern Chrome : W^X enforcement means WASM pages are either RW or RX, not RWX simultaneously. JIT code is written in RW mode, then switched to RX. Exploitation requires finding a write window or using JIT spray. 7. V8 SANDBOX Architecture (V8 ≥ 11.x) Sandbox Escape Vectors Vector Method External pointer table Corrupt entries in the external pointer table to reference arbitrary addresses WASM code pointer Overwrite WASM function entry to jump to controlled shellcode JIT code corruption Write to JIT code page via race condition or confused pointer Mojo IPC (Chrome) Exploit Chrome IPC to attack browser process from compromised renderer Backing store seal bypass Find type confusion to get unsandboxed pointer 8. CHROME SANDBOX ESCAPE (OVERVIEW) After renderer RCE (via V8 exploit), the process is still sandboxed. Full compromise requires: Stage Target Example Renderer exploit V8 / Blink DOM Type confusion → shellcode IPC/Mojo bug Chrome IPC layer Use after free in Mojo interface Browser process exploit Privileged browser process Code execution outside sandbox Mojo interfaces (Chrome's IPC) expose attack surface: find UAF or type confusion in Mojo message handlers. 9. TOOLS 10. DECISION TREE

browser-exploitation-v8