CVE-2024-5830

CVE-2024-5830 - V8 Object Transition Type Confusion (Chrome Renderer RCE)

Overview

CVE-2024-5830 is a type confusion vulnerability in V8's object transition mechanism that achieves full renderer RCE in Chrome 125.0.6422.112 and earlier.

• Affected: Chrome/Chromium older than 125.0.6422.113
• Severity: Critical (renderer RCE from a single page load)
• Author: Man Yue Mo (GitHub Security Lab)
• Source: https://github.com/github/securitylab/tree/main/SecurityExploits/Chrome/v8/CVE_2024_5830
• Analysis: https://github.blog/2024-08-13-from-object-transition-to-rce-in-the-chrome-renderer

Exploit Chain

The exploit (calc.html) implements a complete renderer RCE chain:

1. Type confusion via object transitions - Abuses __defineGetter__ + spread operator to confuse V8's map transition system, producing a corrupted NameDictionary that overlaps with attacker-controlled double arrays.

2. addrof primitive - Leaks the compressed V8 heap pointer of any JS object by placing it in oobObjArr and reading via the corrupted array.

3. Arbitrary V8 heap read/write - Overwrites the backing store pointer of oobDblArr through the corrupted array to read/write arbitrary V8 heap addresses.

4. V8 sandbox escape via DOMRect - Confuses DOMRect with DOMArrayBuffer by swapping wrapper instance pointers. This lets domRect.x be used to set a raw (non-sandboxed) memory address, and AudioBuffer.copyFromChannel / copyToChannel provide full process-wide arbitrary read/write.

5. Code execution - Overwrites the WASM import dispatch table entry to redirect a WASM call to attacker-controlled shellcode embedded in a WASM array.

Shellcode

The WASM module contains x86_64 Linux shellcode that calls:

execve("/bin/xcalc", ["DISPLAY=:0.0"], NULL)

This means:

• Linux x86_64: Full RCE - launches xcalc (or any X11 app).
• Windows x86_64: The type confusion triggers and all primitives (addrof, read, write, sandbox escape) work, but the shellcode crashes instead of executing a program. This still confirms exploitability.
• aarch64 (ARM64): Same as Windows - primitives work but shellcode is wrong architecture. Needs aarch64 shellcode replacement.

Setup

Linux x86_64

chmod +x setup-chrome.sh
./setup-chrome.sh
./run-exploit.sh

This downloads Chrome 125.0.6422.78 for Testing (linux64), creates a local HTTP server, and opens calc.html in the vulnerable browser.

Windows x86_64

.\setup-chrome.ps1
.\run-exploit.bat

Downloads Chrome 125.0.6422.78 for Testing (win64). The type confusion and all memory corruption primitives work; the final shellcode stage crashes (Linux shellcode on Windows) but confirms the full chain up to code execution.

aarch64 Linux (this machine)

No Chrome for Testing arm64 Linux builds are available. Options:

1. Use an x86_64 VM or container with the linux64 Chrome build.
2. Use the Windows setup on an x86_64 Windows machine.
3. Replace the shellcode in the WASM buffer with aarch64 Linux shellcode (requires regenerating the WASM module via import_shell.js).

Chrome Version Notes

• 125.0.6422.78: Known-good vulnerable version available from Chrome for Testing.
• 125.0.6422.112: The version tested by the original author (Ubuntu 22.04 official build). Not available in Chrome for Testing but any Chrome older than 125.0.6422.113 should work.
• The hardcoded V8 heap addresses (dblArrMap, objArrMap, fakeDblArrayAddr, trustedOffset) are specific to the official Chrome 125 build on Linux. Different build configs or platforms may need address adjustments.

Files

File	Description
calc.html	Complete exploit - type confusion through RCE
setup-chrome.sh	Linux setup script (downloads Chrome, creates run script)
setup-chrome.ps1	Windows setup script (PowerShell)
run-exploit.sh	Generated by setup - serves exploit + launches Chrome
run-exploit.bat	Generated by setup - Windows equivalent
README.md	This file