CVE-2024-4947: Chrome V8 Type Confusion — Escaping the Sandbox Through TurboFan

TL;DR

CVE-2024-4947 is a high-severity type confusion bug in V8's TurboFan optimizing compiler that allowed arbitrary code execution in Chrome's renderer process. Chained with a sandbox escape, this enabled full remote code execution through malicious websites before emergency patches in Chrome 125.0.6422.60.

Affected versions

• Google Chrome versions prior to 125.0.6422.60/.61 (Stable channel)
• Chromium-based browsers (Edge, Brave, Opera) using vulnerable V8 versions
• Microsoft Edge prior to version 125.0.2535.51
• All desktop platforms: Windows, macOS, Linux
• ChromeOS prior to version 125.0.6422.68

The vulnerability existed in V8's TurboFan compiler pipeline, specifically affecting the optimization phases that handle JavaScript object type analysis and inline caching.

Root cause

The vulnerability originated in TurboFan's speculative optimization pipeline, specifically within the type narrowing logic for JavaScript objects during the compilation phase. TurboFan performs aggressive optimizations by making assumptions about object types based on runtime feedback.

The core issue resided in the handling of property access operations on objects that undergo prototype chain modifications. When TurboFan compiled optimized code for property accesses, it created a type assumption based on the object's initial state. However, the bounds checking and type guard insertion failed to account for scenarios where:

1. An object's map (V8's internal type descriptor) could transition during prototype pollution
2. Optimized code paths assumed immutable type information that could be invalidated
3. Deoptimization bailouts were insufficiently triggered when type assumptions violated

The type confusion occurred when optimized code treated an object as having properties at specific offsets that differed from the actual runtime layout. This allowed attackers to craft JavaScript that caused the engine to read/write memory at incorrect offsets relative to object boundaries, treating one type of value as another.

Exploitation primitive

Exploitation required several sophisticated steps:

Triggering optimization: Attackers needed to craft JavaScript that would be hot enough for TurboFan to optimize, typically by executing functions 10,000+ times with consistent type feedback.

Type confusion setup: By carefully manipulating prototype chains and object properties, attackers could create a scenario where optimized code's type assumptions became invalid without triggering deoptimization.

Memory corruption: The type confusion allowed treating a JavaScript object pointer as a different type, enabling:

• Reading object metadata to defeat ASLR
• Corrupting array length fields for out-of-bounds access
• Forging JavaScript objects with controlled properties

Arbitrary read/write: Using corrupted array lengths, attackers achieved arbitrary memory access within the renderer process, allowing them to:

• Locate and corrupt V8 internal structures
• Build addrof/fakeobj primitives for object manipulation
• Ultimately achieve code execution in the renderer

Sandbox escape: While CVE-2024-4947 alone provided renderer compromise, exploitation in the wild typically chained it with Windows kernel vulnerabilities or Chrome sandbox escapes to achieve full system compromise.

PoC exploits demonstrated reliable exploitation on Windows 10/11 systems with success rates exceeding 90% on vulnerable Chrome versions.

Mitigation

Immediate actions:

• Update Chrome/Edge to versions 125.0.6422.60 or later immediately
• Enable automatic browser updates if not already configured
• Verify version via chrome://settings/help

Long-term defenses:

• Deploy browser isolation solutions for high-risk environments
• Implement site isolation policies (enabled by default since Chrome 67)
• Use endpoint detection tools monitoring for renderer process anomalies
• Consider enabling Chrome's enhanced safe browsing mode
• For enterprise: Push updates via group policy, disable outdated versions

Defense-in-depth: The patch improved TurboFan's type guard insertion logic and added additional runtime checks for prototype chain mutations. Organizations should still assume renderer compromise is possible and rely on sandbox integrity as the critical security boundary.