CVE-2025-6554

This repository contains a functional exploit PoC for CVE-2025-6554, targeting a type confusion vulnerability in V8's TurboFan optimizer. The exploit leverages incorrect type inference to achieve arbitrary memory read/write, leading to remote code execution.

This PoC exploits a type confusion vulnerability in V8 (CVE-2025-6554) to achieve arbitrary read/write primitives via corrupted array access, enabling sandbox escape. It demonstrates addressof, fakeobj, and memory manipulation techniques.

This repository is an educational writeup for a Google Chrome zero-day vulnerability (CVE-2025-6554), focusing on training materials, lab exercises, and defensive techniques. It does not contain exploit code but provides high-level analysis and mitigation guidance.

This PoC exploits a type confusion vulnerability in V8 JavaScript engine (version 13.8.258.19) to achieve arbitrary read/write primitives and execute shellcode via WebAssembly. The exploit leverages a corrupted array to manipulate object maps and gain memory access.

This PoC exploits a V8 JavaScript engine bug (CVE-2025-6554) where a variable accessed before declaration in combination with a delete operation leaks the internal 'The Hole' sentinel value, enabling type confusion attacks.

The repository contains only a README.md file with a CVE identifier and no additional details or exploit code. It lacks any technical content or proof-of-concept implementation.

This repository contains a working proof-of-concept exploit for CVE-2025-6554, leveraging a type confusion vulnerability in V8 to achieve arbitrary read/write primitives. The exploit demonstrates memory corruption via optimized JavaScript functions and array manipulations.

This PoC demonstrates a JavaScript engine vulnerability (CVE-2025-6554) in V8's bytecode generation, where a missing hole check allows leaking uninitialized values. The exploit uses the `delete` operator on a chained optional property access to trigger the issue.

This PoC demonstrates a V8 JavaScript engine vulnerability (CVE-2025-6554) where improper hole checks in bytecode generation could lead to information leakage. The exploit leverages a missing `ThrowReferenceErrorIfHole` instruction in the return path, allowing access to uninitialized variables.

This PoC demonstrates a type confusion vulnerability in V8 JavaScript engine (CVE-2025-6554) by manipulating array access to leak object properties. The exploit triggers deoptimization and memory leaks, confirming the vulnerability in V8 version 13.8.500258.