PatchGap · Weakness Patterns
Weakness Patterns
A CVE tells you about one bug. A weakness pattern is the class behind it: the same root-cause mechanism and fix shape, recurring across components and vendors. Each page names the invariant the class breaks, walks the shared mechanism, lists every CVE in the corpus that instantiates it, and hands you a runnable audit query to find its siblings in your own codebase — turning “here’s a bug” into “here’s how to stop the class.”
A nested callout frees the object, then it is used
96
A method dispatches into a delegate, observer, callback, or other thread that can synchronously destroy the object (or a cached target), and then keeps using it — a use-after-free reached from ordinary UI, event, or teardown flow.
Authorization check exists but is not enforced on every path
43
A protection is implemented but not applied uniformly across every code path, scheme, redirect hop, handler, or build variant that reaches the protected resource. Unlike wrong-principal authorization, the check is correct in what it evaluates; it simply isn’t invoked everywhere the resource is reachable. An alternate entry point, an early-return branch, an intermediate redirect, or a compiled-out branch slips through unchecked.
A privileged action is authorized against a proxy for identity, not the real principal
35
A capability check passes because a correlated stand-in looks right — a related object merely exists, the wrong end of a channel is trusted, permissions are computed for the source document instead of the destination, or a principal captured earlier is reused after it changed — rather than because the exact principal that owns the capability was checked at the moment of the action. The result is a cross-frame / cross-origin / cross-process authorization bypass.
A size or count is computed in a type too narrow to hold it
28
A byte size, element count, or index that can legally exceed a fixed-width type’s range is computed or stored in 32/16-bit, wraps to a small value, and then bounds an allocation or copy — producing an undersized buffer and an out-of-bounds write.
Trusting GPU driver quirks, clear state, or layout math
26
ANGLE, Dawn, Skia, and WebRTC repeatedly trust a GPU driver to behave as the graphics spec promises, honor an advertised capability, or compute a texture layout correctly, and trust their own cached view of driver binding/clear state. When the driver diverges, or when a stale binding, missing dirty bit, or wrong stride/block/level arithmetic sneaks a size mismatch into a copy, upload, blit, or clear, the result is an out-of-bounds access or memory that is used before it is initialized. Fixes almost never patch the driver; they blocklist or identity-gate the buggy vendor, sidestep the reachable code path, or correct the host-side layout math.
Security UI spoofable via occlusion late-binding timing or geometry
21
Trusted security UI (origin display, permission prompt, fullscreen notice, download or file-access indicator) can be spoofed, occluded, mispositioned, or acted upon against the wrong target. Attacker-controlled content covers, outlives, mistimes, or geometrically displaces the UI, or the user’s action late-binds to a different request or page than the one the UI represented.
A robustness or init safeguard the rest of the code assumes is on is silently off
19
A backend, buffer, or attachment relies on a safeguard the higher layer assumes is always in force — a robustness extension, an unconditional padding, a resource-init flag — but that safeguard is never advertised, is gated on the wrong condition, or is not re-armed after an invalidate/reconfigure, so the guarantee callers depend on is silently absent and an OOB or uninitialized read follows.
Optimizer reuses a type assumption across a map change
18
A TurboFan/Maglev speculation keyed on an object’s map, field representation, or Smi-ness is not invalidated when a migration, deopt, or in-place reconfigure changes it — so post-change memory is read with the pre-change type.
A shared container is mutated from two threads without a lock
15
A map, hash map, or flag reached from more than one thread (GPU IO vs main, async pipeline creation, or concurrent device connections) is accessed without synchronization — a concurrent insert/erase/rehash corrupts it and hands out dangling entries.
Unsound Turboshaft elimination and over-loose typer ranges
15
Turboshaft’s load/store/alias elimination and its typer optimize by proving a memory location or value is unchanged, or by narrowing a value’s range. When that reasoning is unsound it elides an initializing store or bounds check, reuses a stale value, or claims a type narrower than the operation can produce. For a defender this yields OOB access or type confusion from compiler state that no longer matches runtime reality.
A cached GPU object survives a redefine or reallocation
12
A cached render target, framebuffer attachment, descriptor pointer, or sub-allocation still points at backing storage that a redefine, reattach, or container growth has already freed or replaced — so its next use is a use-after-free or an uninitialized read.
Broken deopt/OSR bookkeeping and unsound escape analysis
12
V8’s optimizers rely on precise bookkeeping across deoptimization, on-stack replacement, escape analysis, and allocation folding: which values stay live, which allocations escape, and which code is on the stack. When that accounting undercounts uses, keeps an escaping allocation virtual, folds into a stale block, or picks the wrong OSR/deopt target, a stale or type-confused value is materialized. For a defender this is a class of miscompiles rooted in liveness and escape/OSR state, not in a single operation.
Architecture codegen violates zero-extension and ABI invariants
11
V8’s arm64/x64 code generation and low-level assembly mishandle zero-extension guarantees, callee-saved register widths, displacement overflow, register aliasing, and hidden clobbers. These break the ABI or representation invariants that later stages rely on, producing wrong code that leaves dirty high bits, unbalanced stacks, or clobbered registers. The downstream effect is out-of-bounds access or memory corruption.
Garbage collector traversal and marking invariants violated
11
V8’s heap-snapshot traversal, concurrent marking, and no-allocation scopes are violated by allocation during traversal, torn or misordered bitmap reads and writes, or stale raw pointers held across a GC. This lets the marker see partial state, miss strong fields, or free live objects. The outcome is a use-after-free or read of uninitialized memory.
Front-end validation exempts a record the backend still uses
10
A front-end validator ignores or exempts a binding, count, or identity that the backend still assigns a slot, index, or identity to — so the two layers disagree and the backend indexes out of range, serves the wrong length, or trusts a spoofed record.
Browser process trusts renderer-supplied value without revalidation
9
The privileged browser process accepts a value, flag, length, scheme, or activation state supplied by the untrusted renderer and acts on it without recomputing or bounding it against browser-authoritative state. Because a compromised or malicious renderer controls that input, the browser inherits the renderer’s lie. The defect is one of trust placement, not of a check applied unevenly.
DevTools raw context pointer freed by re-entrant JS
9
A DevTools/Inspector agent borrows a raw pointer to an InspectedContext, InjectedScript, V8DebuggerScript, session, or message storage and holds it across a call that synchronously re-enters attacker-controlled JavaScript. That re-entrant execution destroys the very object still referenced, leaving the agent to dereference freed memory. The lifetime bug is specific to the inspector’s synchronous callouts, not to ordinary async scheduling.
Stale pointer survives destruction order or cleanup path
9
An object is freed while a peer, guard, container, or asynchronous task still holds a pointer into it, or an error path skips the cleanup that a success path performs. The dangling reference is later used, read, or destroyed. The defect is one of static lifetime, destruction ordering, or error-path cleanup, with no re-entry into user code.
Unsound representation selection and phi untagging in V8 optimizers
9
In Maglev and Turboshaft the optimizer chooses machine representations and untagging/retagging conversions for SSA values, especially loop and merge phis. When that selection records or preserves the wrong tag (Smi vs HeapNumber/Float64) or drops a required heap-object check, a value is later read at a type it cannot hold. For a defender this is a compiler-level type confusion that survives the source-level checks and manifests as miscompiled machine code.
WebAssembly subtype decision errors cause type confusion
9
V8’s WebAssembly type system mis-decides subtype relations during type canonicalization, custom-descriptor subtyping, or ref.func exactness stamping. Comparisons that drop type-defining bits (mutability, nullability, exactness, indexedness) or that treat runtime-dependent descriptor identity as statically decidable let a value of one type be accepted where another is required. The result is a type confusion that downstream cast elimination and optimization logic trust.
TDZ hole-check elided across a branch
7
V8 elides a let/const TDZ (the-hole) check based on a linear view of execution, but a conditional branch — a switch jump table, a continue, a labeled break, or a lowered module-variable load — reaches the use without having run the earlier check, so an uninitialized “hole” sentinel flows into code that assumes a real value.
Ignoring a failure result and using the partial output
6
A fallible operation, such as serialization, page decommit, a partial clear, or an archive-entry unpack, returns a failure or partial-completion signal that the caller does not check, then proceeds to consume the incomplete or invalid output as if the operation had fully succeeded. This causes stale or uninitialized memory to be reused, an invalid value to be trusted, or a corrupt artifact to be reported as valid. The unifying flaw is a missing failure branch or an all-or-nothing flag that cannot represent partial progress.
Sandbox or temp directory shared and predictably named
5
A sandboxed or elevated process is confined to (or stages files in) a per-user directory that is shared with, predictable to, or writable by other same-user processes, opening a race, squatting, or search-path surface. A lower-privileged local actor can pre-create, replace, or contend for files the higher-privileged process trusts.
Preparser or protocol parser disagrees with authoritative parse
4
Two parsers over the same input apply different rules, so a fast/pre pass reaches a different conclusion than the authoritative pass. The resulting state desynchronization yields strict-mode escape, swapped reparse ids, smuggled headers, or non-standard token acceptance. The core defect is a parser differential, not a memory error at the parse site itself.
Index-buffer conversion sizes or positions writes without accounting for restart offsets
3
When a GPU backend rewrites an index buffer — for primitive-restart emulation, format conversion, or line-loop expansion — it sizes the destination or computes a write offset from a raw index count, ignoring the per-range begin offsets and whole-primitive rounding that restart and expansion introduce, so a per-range write lands past the allocation or an offset is taken against the wrong origin.
Resizable ArrayBuffer length re-read races background grow
3
V8 reads a resizable or growable ArrayBuffer’s length or byte-length twice with a background-thread grow in between, desynchronizing the two snapshots. A destination array sized from the earlier value is then filled using a larger current length re-read live from the backing store. The mismatch produces an out-of-bounds write.
Download hash inconsistent with bytes actually on disk
2
A download or cache integrity check reports a hash that does not correspond to the bytes actually persisted, because the hashed range and the on-disk range diverge. A resumed or sparse download accumulates a hash over a different byte span than the file that ends up on disk, so the reported digest no longer certifies the stored content.