Google Chrome RCE Vulnerability Details Released Along with Exploit Code

Researchers have disclosed the technical details and exploit code for a critical remote code execution (RCE) vulnerability in the V8 JavaScript engine of Google Chrome.

Technical Details of the Vulnerability

The vulnerability is identified as a WebAssembly type canonicalization bug, which arises from an incorrect nullability check in the CanonicalEqualityEqualValueType function. This issue was introduced by commit 44171ac in Chrome M135 and later versions. The flaw allows an attacker to create two recursive type groups that can collide under the same MurmurHash64A hash value, leading to nullability confusion on indexed reference types.

The exploit takes advantage of a V8 sandbox bypass using JavaScript Promise Integration (JSPI) state-switching flaws found in M137. An attacker can utilize an intra-state confusion in the secondary stack management logic to execute out-of-order stack pivots between nested JS and Wasm stacks.

By bypassing inactive stacks and injecting attacker-controlled values into suspended frames, the exploit achieves full stack control, allowing the construction of a return-oriented programming chain to invoke VirtualProtect on a RWX shellcode buffer.

The proof-of-concept includes an HTML payload and JavaScript code using wasm-module-builder.js to create specific Wasm types and functions. To deploy the exploit, users should navigate to http://127.0.0.1:8000/exp.html . Successful exploitation will execute a Windows calc.exe process through a crafted ROP chain and RWX shellcode.

Enumerates two Wasm recursive type groups with differing nullability and uses a birthday attack across 2 32 MurmurHash64A values to find a collision. Casts a ref null t1 into ref t1, enabling a sandboxed caged read/write primitive through out-of-bounds access to a large ArrayBuffer. Utilizes nested promise-based Wasm exports to force stack switches and exploits a missing SBX_CHECK to skip inactive stack frames, resulting in attacker-controlled execution context. Injects a retsled array of gadget addresses to mark shellcode memory as executable and initiate execution.

Credit for the discovery and development of the exploit goes to Seunghyun Lee (0x10n), the winner of the Chrome RCE category at TyphoonPWN 2025.

A patch has been released to address the nullability regression, restore strict SBX_CHECKs in JSPI, and reinforce type safety in the V8 engine. Users are advised to update to Chrome M137.0.7151.57 or later to mitigate this critical RCE risk.

Based on reporting by Cyber Security News.