V8 type-confusion 1-day → renderer RCE

§ Context

Assumed environment: target user runs an outdated browser. Attacker hosts the exploit on a malicious page (or compromised legitimate site). N-day chain is reproducible and well-documented.

§ Steps

1. 01
   Code-exec in renderer processInitial Access

   T1190— Exploit Public-Facing Application
2. 02
   Drop user-context implantPersistence

   T1547— Boot or Logon Autostart Execution
3. 03
   Lure victim to attacker pageInitial Access

   T1566— Phishing
4. 04
   Achieve addrof + fakeobjExecution

   BRW-V8-TYPE-CONFUSION— V8 Type Confusion → JIT Exploitation
5. 05
   Trigger V8 type confusionExecution

   BRW-V8-TYPE-CONFUSION— V8 Type Confusion → JIT Exploitation
6. 06
   WASM JIT RWX page → shellcodeExecution

   BRW-WASM-OOB— WebAssembly Bounds-Check Bypass
7. 07
   Sandbox escape via Mojo IPCPrivilege Escalation

   BRW-CHROME-IPC— Chromium Mojo IPC Confused-Deputy

§ References

• T1190Exploit Public-Facing Application
• T1547Boot or Logon Autostart Execution
• T1566Phishing

§ Frequently asked

What is the "V8 type-confusion 1-day → renderer RCE" attack path?

Public V8 type-confusion turned into a renderer pop. JS triggers JIT into mis-compiling a polymorphic site, addrof/fakeobj primitives, shellcode in a WASM RWX page. It chains 7 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Code-exec in renderer process (T1190) — a initial access primitive. Assumed environment: target user runs an outdated browser.

What is the final impact of this kill-chain?

The final step lands on Sandbox escape via Mojo IPC (BRW-CHROME-IPC), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques3

  Rowhammer → bit flip → in-browser sandbox escape

  JavaScript hammers adjacent DRAM rows for tens of seconds; an unlucky-for-defender bit flip in a page-table entry hands the attacker a write primitive into another mapping. RIDL-class chain to native code.

• Shared techniques2

  OneNote .one attachment → embedded payload → C2

  OneNote .one file with a friendly 'Double-click to view' overlay hides an embedded HTA / VBS / EXE. Effective initial access vector after Microsoft blocked internet macros in 2022.