EIP-2026-103440
PRE-CVEChrome V8 JIT - Simplified-lowererer IrOpcode::kStoreField_ IrOpcode::kStoreElement Optimization Bug
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-103440. PoCs published by Google Security Research.
AI-analyzed exploit summary This PoC exploits a write barrier elimination bug in V8's JIT compiler, where incorrect handling of `MachineRepresentation::kTaggedSigned` can lead to memory corruption. The exploit demonstrates two scenarios (kStoreField and kStoreElement) where a heap object is incorrectly treated as a Smi, bypassing write barriers and causing object corruption after garbage collection.
Description
Chrome V8 JIT - Simplified-lowererer IrOpcode::kStoreField_ IrOpcode::kStoreElement Optimization Bug
Exploits (1)
This PoC exploits a write barrier elimination bug in V8's JIT compiler, where incorrect handling of `MachineRepresentation::kTaggedSigned` can lead to memory corruption. The exploit demonstrates two scenarios (kStoreField and kStoreElement) where a heap object is incorrectly treated as a Smi, bypassing write barriers and causing object corruption after garbage collection.