EIP-2026-103482

The exploit leverages a type confusion vulnerability in V8's RegExp handling, where altering the map of a RegExp object after a check causes out-of-bounds memory access via lastIndex manipulation. The PoC triggers a crash in Chrome by forcing a dictionary transition and then accessing the corrupted lastIndex.