browser-exploitation-v8

Name: browser-exploitation-v8
Author: Prohao42

91stars8forks

How to install browser-exploitation-v8?

prohao42/aimy-skill/browser-exploitation-v8

$npx -y skills add Prohao42/aimy-skill --skill browser-exploitation-v8

Installs into the current project.

Summary

Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8 sandbox bypass to achieve renderer RCE and sandbox escape in Chrome/Chromium.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Browser / V8 Exploitation — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert V8/Chrome exploitation techniques. Covers V8 compilation pipeline, JIT type confusion, addrof/fakeobj primitives, ArrayBuffer corruption, WASM RWX pages, V8 sandbox (pointer compression), and Chrome sandbox escape overview. Distilled from ctf-wiki browser sections, Project Zero research, and CTF competition patterns. Base models often confuse V8 object representation details and miss the pointer compression barrier.
4
5	## 0. RELATED ROUTING
6
7	- [sandbox-escape-techniques](../sandbox-escape-techniques/SKILL.md) — Chrome renderer sandbox escape via IPC/Mojo
8	- [heap-exploitation](../heap-exploitation/SKILL.md) — general heap concepts applicable to V8 heap
9	- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — ROP concepts for native code execution after V8 escape
10	- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — ASLR/NX bypass in browser context
11
12	### Advanced Reference
13
14	Load [V8_EXPLOITATION_PATTERNS.md](./V8_EXPLOITATION_PATTERNS.md) when you need:
15	- Detailed exploitation patterns and code templates
16	- Heap layout manipulation and GC interaction
17	- V8 sandbox bypass techniques
18	- Object map confusion patterns
19
20	---
21
22	## 1. V8 ARCHITECTURE
23
24	### Compilation Pipeline
25
26	```
27	JavaScript Source
28	↓ Parser
29	AST (Abstract Syntax Tree)
30	↓ Ignition
31	Bytecode (interpreted, profiling)
32	↓ Sparkplug (non-optimizing baseline, V8 ≥ 9.1)
33	Baseline code (fast startup)
34	↓ Maglev (mid-tier, V8 ≥ 10.2)
35	Mid-optimized code
36	↓ TurboFan (optimizing JIT)
37	Optimized machine code (with speculative optimizations)
38	↓ Deoptimization (if speculation fails)
39	Back to Ignition bytecode
40	```
41
42	### Key V8 Concepts
43
44	\| Concept \| Description \|
45	\|---\|---\|
46	\| Tagged pointers \| SMI (Small Integer): `value << 1`, HeapObject: `ptr \\| 1` \|
47	\| Pointer compression \| V8 ≥ 8.0: objects addressed via 32-bit offset from cage base (4GB sandbox) \|
48	\| Maps (Hidden Classes) \| Define object shape: property names, types, offsets \|
49	\| Elements kinds \| Internal array type: `PACKED_SMI_ELEMENTS`, `PACKED_DOUBLE_ELEMENTS`, `PACKED_ELEMENTS`, etc. \|
50	\| Write barrier \| GC bookkeeping when heap pointers are written \|
51	\| Garbage collection \| Orinoco GC: minor (Scavenge) and major (Mark-Compact) \|
52
53	### Object Representation (64-bit, pointer compression)
54
55	```
56	HeapObject in V8 heap (compressed):
57	+0x00: Map pointer (compressed, 32-bit offset)
58	+0x04: Properties/Hash
59	+0x08: Elements pointer (compressed)
60	+0x0C: Length (for arrays)
61	+0x10: Inline properties or backing store data
62	```
63
64	---
65
66	## 2. COMMON V8 BUG CLASSES
67
68	\| Bug Class \| Description \| Example \|
69	\|---\|---\|---\|
70	\| JIT Type Confusion \| TurboFan assumes wrong type after optimization \| Speculative type guard eliminated, wrong operation applied \|
71	\| Incorrect Bounds Elimination \| JIT removes array bounds check based on wrong range analysis \| `CheckBounds` node eliminated → OOB access \|
72	\| Prototype Chain Confusion \| Optimization assumes stable prototype, mutations invalidate \| Prototype change after optimization → wrong property access \|
73	\| Turbofan Reduction Bug \| Incorrect strength reduction or constant folding \| Integer overflow in range analysis \|
74	\| Race Condition \| SharedArrayBuffer + worker thread race \| Type confusion via concurrent modification \|
75	\| Off-by-one in Builtin \| Boundary error in built-in function implementation \| String/Array bounds \|
76	\| Typer Bug \| Incorrect type range computation in TurboFan \| `Typer` says value is in [0, N] but can be N+1 \|
77
78	### Triggering JIT Optimization
79
80	```javascript
81	function vuln(arr) {
82	// ... vulnerable code path ...
83	}
84	// Force optimization by calling many times
85	for (let i = 0; i < 100000; i++) {
86	vuln(arr);
87	}
88	// Or use V8 intrinsics (d8 only):
89	%OptimizeFunctionOnNextCall(vuln);
90	vuln(arr);
91	```
92
93	---
94
95	## 3. EXPLOITATION PRIMITIVES
96
97	### addrof — Leak Object Address
98
99	```javascript
100	// Goal: get the raw heap address of a JavaScript object
101	// Method: type confusion between object array and float array
102	// If we can confuse PACKED_ELEMENTS array with PACKED_DOUBLE_ELEMENTS:
103	// - Write object reference to element of object array
104	// - Read same element as double from confused float array
105	// - Float bits = compressed pointer of the object
106
107	function addrof(obj) {
108	// Setup depends on specific bug
109	// Typically: trigger type confusion so array reads obj ref as float
110	object_array[0] = obj;
111	return ftoi(confused_float_array[0]); // float-to-int conversion
112	}
113	```
114
115	### fakeobj — Create Fake Object Reference
116
117	```javascript
118	// Goal: create a JS reference to an arbitrary heap address
119	// Method: reverse of addrof — write float (raw pointer bits) to float array,
120	//

People who liked this also viewed

6 picks

Type

browser-exploitation-v8

91stars8forks

View on GitHub

How to install browser-exploitation-v8?

prohao42/aimy-skill/browser-exploitation-v8

$npx -y skills add Prohao42/aimy-skill --skill browser-exploitation-v8

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Browser / V8 Exploitation — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert V8/Chrome exploitation techniques. Covers V8 compilation pipeline, JIT type confusion, addrof/fakeobj primitives, ArrayBuffer corruption, WASM RWX pages, V8 sandbox (pointer compression), and Chrome sandbox escape overview. Distilled from ctf-wiki browser sections, Project Zero research, and CTF competition patterns. Base models often confuse V8 object representation details and miss the pointer compression barrier.
4
5	## 0. RELATED ROUTING
6
7	- [sandbox-escape-techniques](../sandbox-escape-techniques/SKILL.md) — Chrome renderer sandbox escape via IPC/Mojo
8	- [heap-exploitation](../heap-exploitation/SKILL.md) — general heap concepts applicable to V8 heap
9	- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — ROP concepts for native code execution after V8 escape
10	- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — ASLR/NX bypass in browser context
11
12	### Advanced Reference
13
14	Load [V8_EXPLOITATION_PATTERNS.md](./V8_EXPLOITATION_PATTERNS.md) when you need:
15	- Detailed exploitation patterns and code templates
16	- Heap layout manipulation and GC interaction
17	- V8 sandbox bypass techniques
18	- Object map confusion patterns
19
20	---
21
22	## 1. V8 ARCHITECTURE
23
24	### Compilation Pipeline
25
26	```
27	JavaScript Source
28	↓ Parser
29	AST (Abstract Syntax Tree)
30	↓ Ignition
31	Bytecode (interpreted, profiling)
32	↓ Sparkplug (non-optimizing baseline, V8 ≥ 9.1)
33	Baseline code (fast startup)
34	↓ Maglev (mid-tier, V8 ≥ 10.2)
35	Mid-optimized code
36	↓ TurboFan (optimizing JIT)
37	Optimized machine code (with speculative optimizations)
38	↓ Deoptimization (if speculation fails)
39	Back to Ignition bytecode
40	```
41
42	### Key V8 Concepts
43
44	\| Concept \| Description \|
45	\|---\|---\|
46	\| Tagged pointers \| SMI (Small Integer): `value << 1`, HeapObject: `ptr \\| 1` \|
47	\| Pointer compression \| V8 ≥ 8.0: objects addressed via 32-bit offset from cage base (4GB sandbox) \|
48	\| Maps (Hidden Classes) \| Define object shape: property names, types, offsets \|
49	\| Elements kinds \| Internal array type: `PACKED_SMI_ELEMENTS`, `PACKED_DOUBLE_ELEMENTS`, `PACKED_ELEMENTS`, etc. \|
50	\| Write barrier \| GC bookkeeping when heap pointers are written \|
51	\| Garbage collection \| Orinoco GC: minor (Scavenge) and major (Mark-Compact) \|
52
53	### Object Representation (64-bit, pointer compression)
54
55	```
56	HeapObject in V8 heap (compressed):
57	+0x00: Map pointer (compressed, 32-bit offset)
58	+0x04: Properties/Hash
59	+0x08: Elements pointer (compressed)
60	+0x0C: Length (for arrays)
61	+0x10: Inline properties or backing store data
62	```
63
64	---
65
66	## 2. COMMON V8 BUG CLASSES
67
68	\| Bug Class \| Description \| Example \|
69	\|---\|---\|---\|
70	\| JIT Type Confusion \| TurboFan assumes wrong type after optimization \| Speculative type guard eliminated, wrong operation applied \|
71	\| Incorrect Bounds Elimination \| JIT removes array bounds check based on wrong range analysis \| `CheckBounds` node eliminated → OOB access \|
72	\| Prototype Chain Confusion \| Optimization assumes stable prototype, mutations invalidate \| Prototype change after optimization → wrong property access \|
73	\| Turbofan Reduction Bug \| Incorrect strength reduction or constant folding \| Integer overflow in range analysis \|
74	\| Race Condition \| SharedArrayBuffer + worker thread race \| Type confusion via concurrent modification \|
75	\| Off-by-one in Builtin \| Boundary error in built-in function implementation \| String/Array bounds \|
76	\| Typer Bug \| Incorrect type range computation in TurboFan \| `Typer` says value is in [0, N] but can be N+1 \|
77
78	### Triggering JIT Optimization
79
80	```javascript
81	function vuln(arr) {
82	// ... vulnerable code path ...
83	}
84	// Force optimization by calling many times
85	for (let i = 0; i < 100000; i++) {
86	vuln(arr);
87	}
88	// Or use V8 intrinsics (d8 only):
89	%OptimizeFunctionOnNextCall(vuln);
90	vuln(arr);
91	```
92
93	---
94
95	## 3. EXPLOITATION PRIMITIVES
96
97	### addrof — Leak Object Address
98
99	```javascript
100	// Goal: get the raw heap address of a JavaScript object
101	// Method: type confusion between object array and float array
102	// If we can confuse PACKED_ELEMENTS array with PACKED_DOUBLE_ELEMENTS:
103	// - Write object reference to element of object array
104	// - Read same element as double from confused float array
105	// - Float bits = compressed pointer of the object
106
107	function addrof(obj) {
108	// Setup depends on specific bug
109	// Typically: trigger type confusion so array reads obj ref as float
110	object_array[0] = obj;
111	return ftoi(confused_float_array[0]); // float-to-int conversion
112	}
113	```
114
115	### fakeobj — Create Fake Object Reference
116
117	```javascript
118	// Goal: create a JS reference to an arbitrary heap address
119	// Method: reverse of addrof — write float (raw pointer bits) to float array,
120	//

People who liked this also viewed

6 picks

Type