VULNERABILITY DETAILS

This is a controlled out-of-cage native write. The attacker controls the copy length and all UTF-16 words after the mandatory leading replacement character. The destination is selectable through an existing correctly tagged External Pointer Table (EPT) entry.

String.prototype.toWellFormed allocates a fresh SeqTwoByteString, but ReplaceUnpairedSurrogates subsequently reloads the destination’s map from attacker-writable sandbox memory. Under the V8 sandbox threat model, a concurrent attacker can replace the map and external-pointer handles before that reload. V8 then resolves an external string data pointer and writes source.length UTF-16 words through it without validating the external resource’s capacity.

The attached standalone test case uses the official memory corruption API and d8 Workers to trigger an 8,192-byte native write through the data pointer of a 21-byte external string backed by a 50-byte native buffer. The write reaches an inaccessible page outside the reported 1-TiB V8 sandbox.

Root cause

At the tested revision:

1. src/init/bootstrapper.cc:2836-2837 installs toWellFormed without a feature gate.
2. src/builtins/string-towellformed.tq:48-53 allocates a fresh SeqTwoByteString and passes it to ReplaceUnpairedSurrogates.
3. src/builtins/builtins-string-gen.cc:1848-1877 reloads the destination map after allocation. Its encoding and length checks are release-disabled CSA_DCHECKs. There is no release check that the destination remains sequential and no check of an external resource’s capacity.
4. src/builtins/builtins-string-gen.cc:25-53 sends every non-sequential map through the external-string path in DirectStringData.
5. src/codegen/code-stub-assembler.h:1118-1128 resolves the cached external string data handle with kExternalStringResourceDataTag.
6. src/strings/unicode.cc:280-285 calls simdutf::to_well_formed_utf16 with source.length, causing an unconditional native copy to the resolved pointer.

The missing post-allocation representation check therefore redirects a length-controlled and mostly data-controlled native write outside the sandbox.

Regression range

A source-level git bisect covered 30,527 V8 revisions between known-good 34f73cc75969dd57165262b8b504475cedd4df9c and current bad a48b78348d46ca248ad7080eb29bf4545378198b. The predicate requires the exact fresh allocation/call and unchecked destination-map reload used by the PoC.

First bad commit:

5c7fca4a61ef96a8834adb98aabe29825c6bb3a9
[string-iswellformed] Implement String#{is,to}WellFormed
Author: Shu-yu Guo <syg@chromium.org>
Author date: 2022-12-22T09:19:20-08:00
Change-Id: I6fa772c70d8307eca047fd839058279ce244f0e0
Cr-Commit-Position: refs/heads/main@{#85002}

Review: https://chromium-review.googlesource.com/c/v8/v8/+/4118066

Last good revision (the first bad commit’s parent):

c74a6cd257df45a816811f22af6004af51681898

VERSION

Chrome Version: N/A; reproduced in d8 from V8 main (development), V8 version 15.3.0 (candidate)

V8 revision:

a48b78348d46ca248ad7080eb29bf4545378198b
2026-08-01T09:04:18-07:00
Update V8 DEPS (trusted)

Operating System: Ubuntu 24.04.4 LTS, Linux 6.8.0-101-generic, x86_64

Build configuration:

is_debug = false
dcheck_always_on = false
v8_enable_sandbox = true
v8_enable_memory_corruption_api = true

d8 SHA-256: 45d04f8f8309595758303a5dbb44d61c8e3f8a6824afebd698b92894df3e2893

REPRODUCTION CASE

Attach poc.js directly and run it with only flags permitted by the V8 sandbox submission rules:

d8 --sandbox-testing --expose-gc --allow-natives-syntax poc.js

Representative output from attached repro.log:

Sandbox testing mode is enabled. Only sandbox violations will be reported, all other crashes will be ignored.
Sandbox bounds: [0x217800000000,0x227800000000)

## V8 sandbox violation detected!

Received signal 11 SEGV_ACCERR 7fc709000000

Test-case mechanics

--expose-gc installs the registered GC extension (src/init/bootstrapper.cc:164,6741-6749). V8 compiles its source as a cached external one-byte string (src/init/bootstrapper.cc:5178-5187). The string is native function gc();, backed by GCExtension::buffer_[50] (src/extensions/gc-extension.h:53-69).

The test case locates this external string and copies its valid resource_ and resource_data_ EPT handles. Seven Workers use Sandbox.MemoryView to:

1. Preinstall those valid handles in the predicted fresh result slot.
2. Continuously replace the result map with the cached external-one-byte map.
3. Race the destination-map reload in ReplaceUnpairedSurrogates.

The external-one-byte map works because the encoding assertion is a compiled-out CSA_DCHECK; DirectStringData uses the representation bits to choose between sequential and external data.

The source contains 4,096 UTF-16 words. Its first word is an unpaired surrogate, which forces allocation and becomes 0xfffd; the remaining words are attacker-controlled 0x4242. The helper consequently attempts an 8,192-byte native write through the GC extension’s external data pointer, overrunning its 50-byte backing buffer and reaching an inaccessible native page.

Allocation-buffer calibration only keeps the Worker race aimed at the exact fresh-object slot and avoids unrelated in-sandbox faults.

Attachments:

• poc.js — standalone memory-corruption-API test case.
• repro.log — clean sandbox-violation transcript.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION

Type of crash: d8 process; V8 sandbox violation (SIGSEGV, SEGV_ACCERR)

Crash State:

Received signal 11 SEGV_ACCERR 7fc709000000

../../v8/out/a15.mca/d8(_ZN2v84base5debug10StackTraceC1Ev+0x1e)
../../v8/out/a15.mca/d8(+0x328fb16)
../../v8/out/a15.mca/d8(+0x1fc8025)
/lib/x86_64-linux-gnu/libc.so.6(+0x45330)
../../v8/out/a15.mca/d8(+0x18b6001)
../../v8/out/a15.mca/d8(+0x31d49bb)

The complete captured trace is attached as repro.log. Registers and an exception record were not captured; reproduction uses d8’s required --sandbox-testing handler without a debugger.

Client ID (if relevant): N/A

CREDIT INFORMATION

Reporter credit:

Salvatore Gulizia (nickname: Serotav)