I Had Some Free Time, So I Tried to Pwn V8

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.himanshuanand.com/2026/08/i-had-some-free-time-so-i-tried-to-pwn-v8
• Blog Title: I Had Some Free Time, So I Tried to Pwn V8
• Suggested Section: Binary Exploitation > Chrome Exploiting > V8 Pointer Compression and Sandbox Escape Chains

🎯 Content Summary

Overview

The post documents a complete, exact-build V8 sandbox escape against Google Chrome for Testing 150.0.7871.46 on Linux x86-64. That browser contains V8 15.0.245.13 at commit 968f19a8970f8d91702d86f0ec1522f3909781b7. The exploit chains three public V8 bugs: CVE-2026-15903, CVE-2026-15776, and a JSPI/JS Dispatch...

🔧 Technical Details

Trigger browser-native JIT optimization without shell intrinsics: When an exploit must execute in a normal webpage, repeatedly invoke the vulnerable function through ordinary native events rather than relying on d8-only helpers such as %OptimizeFunctionOnNextCall. Thousands of synchronous dispatches, separated by short delays, can collect type feedback and trigger optimized compilation while preserving a realistic web attack path.

Convert an out-of-bounds string read into compressed addrof: If an optimizing-compiler error lets a string operation such as charCodeAt read outside its allocation, place arrays containing many copies of one object reference near the string. Search leaked bytes for a repeated odd 32-bit value. In pointer-compressed V8, the low bit marks a tagged heap-object reference; repetition filters random pointer-like data and reveals the object's process-specific offset inside the 4 GB cag...

🤖 Agent Actions

Updated src/binary-exploitation/chrome-exploiting.md.

Added technical coverage for:

• V8 pointer compression and tagged offsets
• Web-compatible JIT tiering
• OOB disclosure to compressed addrof
• Missing GC write-barrier reclamation
• Fake-array caged read/write and stabilization
• ExternalString metadata abuse for ASLR disclosure
• JSPI/JDT arity mismatch and native stack pivot
• W^X-compatible ORW ROP
• Correct V8-versus-process sandbox boundary

Validation passed: clean diff, balanced code fences, consistent numbered citations, no forbidden sources, and all added references return HTTP 200. mdbook was unavailable, so the full book build was skipped.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.himanshuanand.com/2026/08/i-had-some-free-time-so-i-tried-to-pwn-v8

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation > Chrome Exploiting > V8 Pointer Compression and Sandbox Escape Chains".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0