atiilla/cve-2026-85046Proof-of-concept and technical analysis for CVE-2026-85046, a V8 type confusion in inline Array.prototype.sort, including root cause, patch diff, and exploitation chain for Chrome < 152.0.7977.82.
| Field | Value |
|---|
| CVSS | 8.8 (High) |
| CWE | CWE-843 (Type Confusion) |
| Component | V8 JavaScript Engine -- Maglev/Turbofan inline sort |
| Affected | Chrome < 152.0.7977.82, all Chromium-based browsers |
| Fixed | Chrome 152.0.7977.82 (2026-09-03) |
| Fix commit | e0562d87ad9c17042b581582c99237d798572e67 |
| CISA KEV | Added 2026-09-04, deadline 2026-09-18 |
| Wild exploitation | Yes (confirmed by Google) |
| Reporter | Salvatore Gulizia (Serotav) |
The inline sort optimization accepts polymorphic element-kind feedback (PACKED_SMI_ELEMENTS + PACKED_ELEMENTS). When the comparator calls arr.fill(0), V8 migrates the receiver map backward from PACKED_ELEMENTS to PACKED_SMI_ELEMENTS. The post-sort map check passes because PACKED_SMI_ELEMENTS was in the original feedback set. The copy-back writes object pointers into an array whose map claims SMI-only elements.
The fix adds a precondition requiring all receiver maps in the feedback to share the same elements_kind before inlining sort.
| File | Description |
|---|---|
patch-analysis.md | Full patch diff analysis with root cause, trigger mechanism, and exploitation primitive assessment |
patch-analysis.json | Structured data: commit hashes, CWE, affected versions, exploit primitives |
v8-research.md | V8 element kinds deep dive, prior art PoCs (CVE-2020-6418, CVE-2025-2135, CVE-2024-4947, etc.), sandbox architecture, escape techniques |
poc-minimal.js | Minimal type confusion trigger for d8 (d8 --allow-natives-syntax poc-minimal.js) |
poc.html | Full exploitation chain: type confusion, addrof primitive, heap spray, fakeobj via backing store overlap, information leakage |
exploit-notes.md | Technical writeup: step-by-step chain, heap layout diagrams, pointer compression, sandbox impact, detection indicators, remediation |
# With V8 debug helpers
d8 --allow-natives-syntax poc-minimal.js
# Without (heuristic verification via String())
d8 poc-minimal.js
Open poc.html in Chrome < 152.0.7977.82. The exploit runs automatically and logs each stage to the page and developer console. Stages:
arr.fill(0) in sort comparatoraddrof primitive -- leaks compressed heap pointers as integersfakeobj via overlap -- forges object references from controlled integersTraining (2000 iter)
|
v
Type confusion: PACKED_ELEMENTS map -> PACKED_SMI_ELEMENTS map
(backing store still holds object pointers)
|
v
addrof: String(confused_array) leaks pointers as integers
|
v
fakeobj: double/object array overlap writes controlled pointer
|
v
Fake JSArray with controlled elements pointer -> arbitrary R/W (intra-cage)
|
v
Code execution inside V8 sandbox (requires sandbox escape for full RCE)
kMaxInlineSortLength)arr.fill() with SMI values for backward map migrationPACKED_SMI and PACKED_ELEMENTS arrays must be passed during training