Type Confusion in Google Chrome V8

This repository contains a proof-of-concept (POC) exploit for CVE-2025-2135, a vulnerability in Google's V8 JavaScript engine. The exploit is implemented in a single JavaScript file (poc-CVE-2025-2135.js) and is accompanied by a detailed README.md explaining the vulnerability and exploitation technique. The exploit leverages manipulation of large JavaScript arrays and V8's internal object layouts to create a 'fake' array object, which is then used to gain arbitrary address read and write capabilities within the V8 heap. This allows the attacker to read and write memory at arbitrary addresses, a powerful primitive for further exploitation. The exploit is designed for research and debugging purposes and requires a custom-built V8 engine at a specific commit, with certain flags enabled. There are no network or external endpoints; the attack vector is local, requiring the ability to execute JavaScript in the vulnerable V8 environment. The code demonstrates advanced exploitation techniques relevant to browser and JavaScript engine security research.

This repository contains a proof-of-concept exploit for CVE-2025-2135, targeting the V8 JavaScript engine (version 13.3.415.19) as used in Chromium-based browsers. The main file, exp.js, is a standalone exploit script designed to be run in the d8 shell with the --allow-natives-syntax flag. The exploit leverages advanced JavaScript engine internals, including JIT optimization and object structure manipulation, to achieve arbitrary memory read and write capabilities. It requires a helper.js file (not included) that provides the Helper class and related low-level primitives. The exploit demonstrates the ability to create fake objects, leak addresses, and manipulate memory, which can be used as a foundation for further exploitation such as sandbox escape or remote code execution. No network endpoints or external services are targeted; the attack vector is local, requiring the ability to execute JavaScript in the vulnerable engine context. The repository structure is minimal, consisting of a README and the main exploit script.