Reviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome Browser
summary
Compares Maglev to Turbofan, maps concrete attack surfaces (graph building, register allocation, deoptimization), and claims use of Crash-based Fuzzing, differential fuzzing and CodeQL to find bugs; reports 7 high-risk vulnerabilities discovered and one used to get render RCE against Chrome 107. Describes tools: V8 simulator, a modified JIT fuzzer and JIPer, shows a two‑day chain from crash to exploit and concrete root causes like register lifetime and context confusion.
AI-written summary · about
chapters (12)
- 0:00Introduction to speakers
- 0:23V8 compiler architecture
- 2:48Maglev compiler overview
- 3:57Maglev design and stages
- 7:17Maglev vs. TurboFan
- 9:31Vulnerability research
- 12:08Debugging Maglev
- 14:38Graph building bugs
- 18:15Register allocation bugs
- 22:38Deoptimization bugs
- 29:12RCE exploitation story
- 34:00Conclusions and takeaways
related talks
35mThe Hat Trick: Exploit Chrome Twice from Runtime to JIT
49mChrome Browser Exploitation: from zero to heap sandbox escape
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
48mA Weakness In Chrome & A New Hacking Technique
15mSqueezing Juicy Variant Bugs Out of Modern Browsers
51mExploiting Hardware Glitches And Side Channels In Perfect Software
27mAttacking the WebAssembly Compiler of WebKit