Google V8 · Public exploit code

Researchers Execute Code in Chrome via Three V8 Flaws

Nov 03, 2026 · 1 min read

Researchers report three flaws in V8, the JavaScript engine in Chrome: type confusion CVE-2026-78938 in Promise.prototype.finally, CVE-2026-79236 in TurboFan, and a sandbox escape via shared WebAssembly memory. Two exploit chains combine the flaws and achieve code execution in the renderer process, earning two v8CTF flags. The source does not state whether a fix is available; apply the Chrome update once released.

By HIFY Radar newsroom Updated 11/03/2026 05:23 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityPublic exploit codeFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Researchers found three flaws in V8, the JavaScript engine in Chrome, and built two attack chains that execute code in the browser renderer process. The work earned two v8CTF flags.

Why it matters

The flaws sit in the engine that runs every website opened in Chrome; a malicious page would be enough to trigger the chain. The result is code execution inside the browser, a gateway to session and user data theft.

What to do

Apply the next Chrome update as soon as it ships and confirm auto-update is enabled; the source does not state a fix is available. Reinforce caution with unknown websites in the meantime.

For the technical team

CVE: CVE-2026-78938
Affected: Google V8 (motor JavaScript do Chrome) · V8, the JavaScript engine in Chrome; affected versions not stated in the source.
Exploitation: Proof of concept by researchers: using the dfs-large1 tool, they built two complete chains, each achieving code execution in the renderer process, earning two v8CTF flags. No in-the-wild exploitation reported in the source.
Fix: Not stated in the source.
Vector: Three V8 flaws exploitable via JavaScript on a web page. CVE-2026-78938: type confusion in Promise.prototype.finally; internal helpers were non-strict and constructable.caller exposed one of them, new could return a number and TurboFan eliminated the object check, letting attacker-controlled integer bits be interpreted as a pointer in optimized code. CVE-2026-79236: load-elimination bug in TurboFan retained a pointer to the old property array after the object migrated; a write through the stale pointer yielded a controlled memory write. Issue 546253900: sandbox escape via shared WebAssembly memory; the registered backing store differed from the one passed to the worker, worker termination left a native Isolate reference dangling on the other store, and memory.grow(0) triggered a native use-after-free outside the V8 sandbox.
More details: Attack path: both memory corruption bugs provided controlled access inside the pointer-compression cage, used to build addrof and fakeobj primitives; genuine DataView objects were located to reach mapped memory elsewhere in the sandbox before the native escape. Disclosed via @ptdbugs (dbugs).