High chrome Type Confusion 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactType confusion in V8
DescriptionType confusion in V8
ComponentV8
Bug ClassType Confusion
Tracker545767601
Fix commit6f81b563fa9e (v8/v8) +1/-0
CISA KEVNot listed
CreditedZhenpeng (Leo) Lin at depthfirst
Disclosed2026-08-25

Files Changed

  • src/heap/setup-heap-internal.cc
From 6f81b563fa9e3fde15412b0e3ab2b1e2b7e6d0d7 Mon Sep 17 00:00:00 2001
From: pthier <pthier@chromium.org>
Date: Fri, 21 Aug 2026 11:58:35 +0200
Subject: [PATCH] Native builtins are strict

There was a discrepancy between native builtins registered in
bootstrapper vs setup-heap-internal.
The former marked the builtins as strict, whereas the latter didn't.

Mark builtins as strict also in setup-heap-internal.

Fixed: 545767601
Change-Id: Ida4da4bdcfe7dcfdc16f1da0ec022a65cf853ce8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8274474
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#109425}
---

diff --git a/src/heap/setup-heap-internal.cc b/src/heap/setup-heap-internal.cc
index b6d23f6..e7b27b1 100644
--- a/src/heap/setup-heap-internal.cc
+++ b/src/heap/setup-heap-internal.cc
@@ -75,6 +75,7 @@
   DirectHandle<SharedFunctionInfo> shared =
       isolate->factory()->NewSharedFunctionInfoForBuiltin(
           isolate->factory()->empty_string(), builtin, len, kAdapt, kind);
+  shared->set_language_mode(LanguageMode::kStrict);
   return shared;
 }
 
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.