CVE-2024-4947: Chrome V8 Type Confusion — Exploiting TurboFan's Optimization Pipeline

TL;DR

A type confusion bug in Chrome's V8 TurboFan JIT compiler (CVE-2024-4947) allowed attackers to violate type safety guarantees through malformed JavaScript, leading to out-of-bounds memory access and remote code execution. Google patched this in Chrome 125.0.6422.112/.113 after active in-the-wild exploitation was detected.

Affected versions

• Google Chrome versions prior to 125.0.6422.112 (Stable channel)
• Google Chrome versions prior to 125.0.6422.113 (Extended Stable channel)
• Chromium-based browsers (Microsoft Edge, Brave, Opera, Vivaldi) using vulnerable V8 versions
• V8 JavaScript engine versions prior to 12.5.227.19
• Electron applications bundled with affected V8 versions

This vulnerability affected all major desktop platforms: Windows, macOS, Linux, and ChromeOS.

Root cause

The vulnerability originated in V8's TurboFan optimizing compiler, specifically in how it handled type feedback and performed speculative optimizations. TurboFan uses a multi-tiered compilation approach where frequently-executed "hot" functions are optimized based on observed type patterns.

The bug occurred in the type narrowing logic during the Typer phase of TurboFan's optimization pipeline. When processing certain JavaScript operations involving object property access, the compiler made incorrect assumptions about object layouts and element kinds. Specifically, the issue manifested when:

1. JavaScript code triggered transitions between different hidden classes (V8's internal object representation)
2. The optimizer incorrectly assumed immutability of certain type constraints
3. Deoptimization guards were improperly eliminated during redundancy elimination passes

This created a situation where the generated machine code expected one object layout (e.g., SMI/small integer array) but received another (e.g., double array or object array), causing the code to read/write memory at incorrect offsets. The confusion between different element kinds is particularly dangerous because V8 uses different internal representations: packed vs. holey arrays, SMI vs. double vs. tagged elements.

Exploitation primitive

Exploitation required triggering the vulnerability through carefully timed JavaScript that manipulated object shapes to desynchronize the compiler's type assumptions from runtime reality:

javascript copy
// Simplified conceptual example
function trigger(arr, idx) {
  return arr[idx];  // Optimized assuming SMI elements
}

// Train TurboFan with consistent types
for (let i = 0; i < 10000; i++) {
  trigger([1, 2, 3], 0);
}

// Trigger type transition during optimized execution
let confusedArray = [1, 2, 3];
confusedArray[0] = 1.1;  // Transition to PACKED_DOUBLE_ELEMENTS
trigger(confusedArray, maliciousIndex);

Successful exploitation provided:

• Out-of-bounds read: Reading adjacent memory as JavaScript values, leaking addresses to defeat ASLR
• Out-of-bounds write: Writing controlled values beyond array bounds, corrupting adjacent objects
• Type confusion: Treating doubles as pointers or vice versa, enabling arbitrary address construction

Attackers typically chained this primitive with:

1. ArrayBuffer manipulation to create addrof/fakeobj primitives
2. WebAssembly memory corruption for reliable code execution
3. Sandbox escapes via renderer process exploitation followed by Mojo IPC vulnerabilities

Mitigation

Immediate actions:

• Update Chrome to version 125.0.6422.112 or later immediately
• Update all Chromium-based browsers (Edge auto-updates; check manually for others)
• Restart browser completely (closing all windows) to apply the update
• Check chrome://settings/help to verify version

Enterprise mitigations:

• Deploy emergency Chrome updates via MDM/GPO
• Enable Chrome Enterprise policies to force updates
• Monitor for CVE-2024-4947 exploitation attempts via EDR telemetry
• Consider temporary blocking of untrusted JavaScript-heavy sites

Developer mitigations:

• Update Electron applications to versions bundled with V8 12.5.227.19+
• Implement Content Security Policy (CSP) with strict-dynamic
• Enable Site Isolation features
• Test applications with updated V8 builds

Long-term hardening:

• V8 team implemented additional type system verification passes
• Enhanced fuzzing coverage for TurboFan optimization sequences
• Runtime verification of type assumptions during deoptimization
• Improved telemetry for detecting type confusion attempts

Google's report indicated active exploitation in the wild, making this a critical-priority patch. The vulnerability demonstrates that JIT compilers remain a high-value target for attackers despite decades of hardening efforts.