Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2024-0519-rca-research — CVE-2024-0519 root cause analysis | Kitploit
Tools/GitHubGitHub/insaida/cve-2024-0519-rca-research
Vulnerability AnalysisExploitationPapers & ResearchLearning & EducationBinary Exploitation
GitHubinsaida/cve-2024-0519-rca-research

cve-2024-0519-rca-research

CVE-2024-0519 root cause analysis

View Repository
113 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2024-0519 — RCA Research

Root cause analysis artifacts for CVE-2024-0519 (V8 out-of-bounds memory access, Chrome 120, exploited in the wild).

Fix: e0f2a195d87c9a06685121e0e783efd92d030df3 — Toon Verwaest, 2024-01-12
V8 version studied: 12.0.267.16 (fbc4963bbff), ARM64 macOS

Files

PathDescription
harness/test-toctou-race.ccC++ cctest confirming the TOCTOU race window in GetOwnFastDataPropertyFromHeap
harness/test-toctou-chain.ccC++ cctest demonstrating filler embedded as HeapConstant via the broker pipeline
js/poc_325020448.jsZero-intrinsics JS trigger for chromium:325020448 (sibling bug, no public CVE)
js/regress_325020448.jsOfficial V8 regression test for chromium:325020448 (requires --allow-natives-syntax)
patches/e0f2a195.mdFix commit metadata

Quick start

root@kitploit:~
# Pre-patch d8 (V8 12.0.267.16, one commit before e0f2a195)
./d8 --concurrent-recompilation js/poc_325020448.js

# C++ cctests — integrate into V8 cctest build, then:
./cctest test-toctou-race/ToctouRaceDeleteProperty
./cctest test-toctou-chain/EndToEndChainInstallNoPatch
./cctest test-toctou-chain/ConsequenceJSConsumption

See BUILD.md for build instructions.

chromium:325020448

Sibling bug in the same PropertyConstness::kConst class — constness not generalized across prototype transitions. Fixed by 496f467bb72 (Feb 19, 2024), five weeks after the CVE-2024-0519 fix. No public CVE assigned. Affects Chrome 122 (post-CVE-2024-0519 patch) through Chrome 123.

js/poc_325020448.js triggers it without any V8 natives flags.

Download Tool