CVE-2024-2887

This writeup describes CVE-2024-2887, a V8 WebAssembly type confusion vulnerability allowing addrof and fakeobj primitives via overflowing the kV8MaxWasmTypes limit. The exploit leverages WasmModuleBuilder to manipulate type indices and achieve memory corruption.

This PoC demonstrates a type confusion vulnerability in Google Chrome's WebAssembly (Wasm) implementation, leading to arbitrary WASM type confusion and potential remote code execution (RCE). It exploits a flaw where canonicalized type indexes are mistakenly treated as normal type indexes, allowing manipulation of memory structures.

This PoC exploits a type confusion vulnerability in V8's WebAssembly GC implementation by generating a large number of struct types to trigger a crash or bug. It automates the process of testing different type counts to find the threshold that causes the issue.