skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

browser-exploitation-v8

Plan V8 JavaScript engine exploitation chains from bug classes to sandbox escape vectors.

2|Updated May 15, 2026
Search Tags:#browser security#wasm#v8#memory corruption#type confusion#jit exploitation#sandbox escape
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill browser-exploitation-v8
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: browser-exploitation-v8
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/browser-exploitation-v8
Command: npx skills add https://github.com/lNwNl/Methodos --skill browser-exploitation-v8

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps security researchers reason about and plan exploitation chains for JavaScript engines, specifically V8 and Chrome renderer escape paths, when targeting JIT type confusion, bounds-check elimination mistakes, and sandbox bypass steps.

Core Features & Use Cases

  • V8 architecture walkthrough: maps the compilation/optimization pipeline and key runtime concepts (maps, elements kinds, pointer compression, GC behavior).
  • Bug-class to primitive mapping: translates common V8 vulnerability classes into exploitation primitives like addrof, fakeobj, and OOB read/write.
  • Sandbox and Chrome escape overview: explains how V8 sandbox cage constraints affect ArrayBuffer/WASM strategies and what kinds of browser-process escape conditions are typically needed.
  • Practical decision framework: provides a decision tree for choosing exploitation paths based on identified bug type and whether the sandbox is enabled.

Quick Start

Ask the AI to produce a step-by-step exploitation plan for a discovered V8 JIT type confusion bug, including the expected primitives and how pointer compression/sandbox constraints change the chain.

Frequently Asked Questions about browser-exploitation-v8

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a V8 JIT type confusion bug to get renderer RCE?▼

To achieve renderer RCE from a V8 JIT type confusion bug, map the bug to primitives like addrof/fakeobj and OOB read/write, then follow a structured decision tree to chain them into code execution.

What is the best way to map V8 vulnerability classes to exploitation primitives?▼

Mapping V8 vulnerability classes to exploitation primitives involves translating JIT optimization bugs, like incorrect bounds elimination or typer mistakes, into addrof, fakeobj, or OOB read/write actions. The Skill outlines this bug-class to primitive mapping.

How does pointer compression affect V8 exploitation strategies?▼

Pointer compression constrains V8 exploitation strategies by limiting pointer manipulation within the sandbox cage, directly affecting ArrayBuffer and WASM exploitation techniques. The Skill details these constraint impacts.

Can I use this to plan a Chrome sandbox escape after a V8 renderer exploit?▼

Yes, you can plan a Chrome sandbox escape after a V8 renderer exploit by analyzing sandbox cage constraints and identifying browser-process escape vectors. The Skill guides sandbox escape reasoning and outlines next-step decision trees.

Do I need to understand V8 architecture to exploit JIT bounds-check elimination mistakes?▼

Yes, understanding V8 architecture, including the compilation pipeline, maps, elements kinds, and GC behavior, is required to exploit JIT bounds-check elimination mistakes effectively. The Skill provides this architectural context.

When do I need to consider WASM strategies during V8 JIT exploitation?▼

You need to consider WASM strategies during V8 JIT exploitation when crafting read/write primitives or bypassing sandbox cage constraints, as WASM modules provide useful memory layout controls. The Skill covers these ArrayBuffer and WASM strategies.

Related Skills

Explore More Software Engineering Skills→
tkerseytkersey
66

web-browser

Automate Chrome/Chromium via CDP to navigate, click, fill forms, evaluate JavaScript, and capture screenshots.

Community
Intermediate
DorianGalloDorianGallo
5

sandbox-escape-techniques

Identify sandbox isolation types and select escape strategies for Python, seccomp, chroot, and container environments.

Community
Advanced
rainoftimerainoftime
17

garbage-collector-implementer

Implement tracing garbage collectors with mark-sweep, mark-compact, and copying algorithms.

Community
Advanced
Prohao42Prohao42
120

browser-exploitation-v8

Analyze V8 JavaScript engine vulnerabilities and sandbox bypass techniques.

Community
Advanced