jaf0rk/CVE-2026-14431
GitHub: jaf0rk/CVE-2026-14431
针对 V8 引擎 Maglev 编译器中 CVE-2026-14431 类型混淆漏洞的概念验证代码，提供沙箱内任意读写原语。
Stars: 0 | Forks: 1
# CVE-2026-14431
## Bug 修复
https://chromium-review.googlesource.com/c/v8/v8/+/7950517
```
[maglev] Check map of inlined array in ArrayIteratorPrototypeNext
Fixed: 523884658
Change-Id: I2a2bba817952d7023eb4b97ad41d8bb460fb9359
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7950517
Commit-Queue: Leszek Swirski
Reviewed-by: Leszek Swirski
Auto-Submit: Victor Gomes
Cr-Commit-Position: refs/heads/main@{#108053}
```
## 环境
**OS**: Ubuntu 24.04 noble x64
**v8 version**: 14.9.207.29
```
commit 6511f6cfab1f24c360d0fb737d205c27da48a623 (HEAD -> 14.9.207.29, tag: 14.9.207.29-pgo, tag: 14.9.207.29, origin/chromium/7827_155)
Author: V8 Autoroll
Date: Thu Jun 11 12:20:33 2026 -0700
Version 14.9.207.29
Version incremented at https://cr-buildbucket.appspot.com/build/8679264328861571937
Change-Id: I5634f3737fbc1d77d27f7563c2575894bdb203d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7927432
Bot-Commit: v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com
Cr-Commit-Position: refs/branch-heads/14.9@{#57}
Cr-Branched-From: 8f08364a351ad38a60421137a09ef23953ecdd56-refs/heads/14.9.207@{#1}
Cr-Branched-From: 8de67b11924d5e8c0032029165a52d800cf05f1f-refs/heads/main@{#106999}
```
**build args**:
```
# 在此处设置构建参数。参见 `gn help buildargs`。
is_debug = false
dcheck_always_on = false
v8_symbol_level = 2
v8_enable_object_print = true
v8_enable_sandbox = true
target_os = "linux"
target_cpu = "x64"
```
## 用法
通过以下命令运行 ExP：
```
d8 --allow-natives-syntax exp.js
```
## 补充说明
此漏洞质量很高且非常容易利用。由于该漏洞相对较新，我尚未找到合适的 V8 沙箱逃逸漏洞来与其进行组合利用。当前的 ExP 仅在 V8 沙箱内提供读写原语。
关于 V8 沙箱逃逸部分的研究仍在进行中。
标签：Chrome, JavaScript引擎, V8引擎, Web报告查看器, 数据可视化, 自定义脚本