Chrome · V8
CVE-2025-6554
Type Confusion in V8
Overview
High
Severity
—
CVSS
Yes
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
hole_check_scope_src/interpreter/bytecode-generator.cc |
modified |
Files Changed
src/interpreter/bytecode-generator.cc
Patch
From 22e9d9621de58ec6fe6581b56215059a48451b9f Mon Sep 17 00:00:00 2001
From: Stephen Roettger <sroettger@google.com>
Date: Thu, 26 Jun 2025 10:33:16 +0200
Subject: [PATCH] [interpreter] don't elide hole checks across optional chain
Bug: 427663123
Change-Id: Iefdb15828d807bf9452b88e918a4b46cc2d422fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6678591
Commit-Queue: Stephen Röttger <sroettger@google.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#101050}
---
diff --git a/src/interpreter/bytecode-generator.cc b/src/interpreter/bytecode-generator.cc
index 921a8d0..1b8966c9 100644
--- a/src/interpreter/bytecode-generator.cc
+++ b/src/interpreter/bytecode-generator.cc
@@ -1221,7 +1221,8 @@
public:
explicit OptionalChainNullLabelScope(BytecodeGenerator* bytecode_generator)
: bytecode_generator_(bytecode_generator),
- labels_(bytecode_generator->zone()) {
+ labels_(bytecode_generator->zone()),
+ hole_check_scope_(bytecode_generator) {
prev_ = bytecode_generator_->optional_chaining_null_labels_;
bytecode_generator_->optional_chaining_null_labels_ = &labels_;
}
@@ -1236,6 +1237,9 @@
BytecodeGenerator* bytecode_generator_;
BytecodeLabels labels_;
BytecodeLabels* prev_;
+ // Use the same scope for the entire optional chain, as links earlier in the
+ // chain dominate later links, linearly.
+ HoleCheckElisionScope hole_check_scope_;
};
// LoopScope delimits the scope of {loop}, from its header to its final jump.
@@ -6483,9 +6487,6 @@
void BytecodeGenerator::BuildOptionalChain(ExpressionFunc expression_func) {
BytecodeLabel done;
OptionalChainNullLabelScope label_scope(this);
- // Use the same scope for the entire optional chain, as links earlier in the
- // chain dominate later links, linearly.
- HoleCheckElisionScope elider(this);
expression_func();
builder()->Jump(&done);
label_scope.labels()->Bind(builder());
Loading diff…
Original Bug Report
reported by cl...@google.com
[0-day] delete construct leaking TheHole
NOTE: We have evidence that the following bug is being used in the wild. Therefore, this bug is subject to a 7 day disclosure deadline
VULNERABILITY DETAILS
Context shared with saelo@ and tsuro@. The following construct is leaking the_hole value which, combined with a typer bug can lead to arbitrary r/w within the v8 heap sandbox.
delete {}.R?.O[{}.a = f];
%DebugPrint(f);
let f = {};
VERSION Chrome Version: HEAD + stable Operating System: all
REPRODUCTION CASE
The attached p.js triggers a crash in PushStackTraceAndDie. Samuel and Stephen are working on a reproducer triggering a memory corruption.
CREDIT INFORMATION Reporter credit: Clement Lecigne of Google’s Threat Analysis Group
References
On This Page