(depthfirst.com) From JavaScript to Renderer Code Execution: Exploiting Three Critical V8 Vulnerabilities in Chrome In brief - This article describes the discovery and exploitation of three vulnerabilities in Chrome's V8 JavaScript engine, including two memory corruption bugs and one sandbox escape. The researchers demonstrate how these flaws can be chained together to achieve native code execution within the Chrome renderer process. Technically - This article details CVE-2026-78938, a type confusion in Promise.prototype.finally where an internal helper is incorrectly marked as constructable, allowing a Smi to be returned as an object and bypassing TurboFan's CheckHeapObject. It also covers CVE-2026-79236, a TurboFan load-elimination bug where a stale pointer to a PropertyArray is retained across object migration, enabling controlled memory writes. These are combined with a sandbox escape (issue 546253900) involving a use-after-free of a native Isolate pointer caused by a discrepancy between shared WebAssembly memory serialization and backing-store registration. The full exploit chain utilizes addrof/fakeobj primitives, a forged string layout for memory disclosure, and a WebSocket-based heap spray to reclaim the freed isolate and execute a ROP chain. Source: https://depthfirst.com/research/from-javascript-to-renderer-code-execution-three-v8-vulnerabilities-and-two-v8ctf-flags #Cybersecurity