High chrome Type Confusion ⚠️ Exploited in the wild 📄 Reporter bug report 🔧 Commit mapped

Overview

High
Severity
CVSS
Yes
Exploited ITW
Fixed
Fix Status
ImpactType Confusion in V8
DescriptionType Confusion in V8
ComponentV8
Bug ClassType Confusion
Tracker427663123
Fix commit22e9d9621de5 (v8/v8) +5/-4
CISA KEVNot listed
CreditedClément Lecigne of Google's Threat Analysis Group
Disclosed2025-06-30

Changed Functions

FunctionChangeNotes
hole_check_scope_
src/interpreter/bytecode-generator.cc
modified

Files Changed

  • src/interpreter/bytecode-generator.cc
From 22e9d9621de58ec6fe6581b56215059a48451b9f Mon Sep 17 00:00:00 2001
From: Stephen Roettger <sroettger@google.com>
Date: Thu, 26 Jun 2025 10:33:16 +0200
Subject: [PATCH] [interpreter] don't elide hole checks across optional chain

Bug: 427663123
Change-Id: Iefdb15828d807bf9452b88e918a4b46cc2d422fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6678591
Commit-Queue: Stephen Röttger <sroettger@google.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#101050}
---

diff --git a/src/interpreter/bytecode-generator.cc b/src/interpreter/bytecode-generator.cc
index 921a8d0..1b8966c9 100644
--- a/src/interpreter/bytecode-generator.cc
+++ b/src/interpreter/bytecode-generator.cc
@@ -1221,7 +1221,8 @@
  public:
   explicit OptionalChainNullLabelScope(BytecodeGenerator* bytecode_generator)
       : bytecode_generator_(bytecode_generator),
-        labels_(bytecode_generator->zone()) {
+        labels_(bytecode_generator->zone()),
+        hole_check_scope_(bytecode_generator) {
     prev_ = bytecode_generator_->optional_chaining_null_labels_;
     bytecode_generator_->optional_chaining_null_labels_ = &labels_;
   }
@@ -1236,6 +1237,9 @@
   BytecodeGenerator* bytecode_generator_;
   BytecodeLabels labels_;
   BytecodeLabels* prev_;
+  // Use the same scope for the entire optional chain, as links earlier in the
+  // chain dominate later links, linearly.
+  HoleCheckElisionScope hole_check_scope_;
 };
 
 // LoopScope delimits the scope of {loop}, from its header to its final jump.
@@ -6483,9 +6487,6 @@
 void BytecodeGenerator::BuildOptionalChain(ExpressionFunc expression_func) {
   BytecodeLabel done;
   OptionalChainNullLabelScope label_scope(this);
-  // Use the same scope for the entire optional chain, as links earlier in the
-  // chain dominate later links, linearly.
-  HoleCheckElisionScope elider(this);
   expression_func();
   builder()->Jump(&done);
   label_scope.labels()->Bind(builder());
Loading diff…

Original Bug Report

reported by cl...@google.com

[0-day] delete construct leaking TheHole

NOTE: We have evidence that the following bug is being used in the wild. Therefore, this bug is subject to a 7 day disclosure deadline

VULNERABILITY DETAILS

Context shared with saelo@ and tsuro@. The following construct is leaking the_hole value which, combined with a typer bug can lead to arbitrary r/w within the v8 heap sandbox.

delete {}.R?.O[{}.a = f];
%DebugPrint(f);
let f = {};

VERSION Chrome Version: HEAD + stable Operating System: all

REPRODUCTION CASE The attached p.js triggers a crash in PushStackTraceAndDie. Samuel and Stephen are working on a reproducer triggering a memory corruption.

CREDIT INFORMATION Reporter credit: Clement Lecigne of Google’s Threat Analysis Group

View on issue tracker