Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports without the Chrome Security team. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: Maglev’s BuildStringConcat fails to verify if a string constant is safe to read on a background thread. This creates a data race with in-place string externalization on the main thread, potentially leading to an out-of-bounds write within the V8 sandbox.

Affected files:

• v8/src/maglev/maglev-graph-builder.cc
• v8/src/objects/string.cc

Estimated timestamp from git blame: 2026-01-13

Summary

A race condition exists in V8’s Maglev compiler during the constant-folding of string concatenations. The MaglevGraphBuilder::BuildStringConcat function retrieves string constants from the graph and attempts to concatenate them on a background compiler thread. However, unlike TurboFan, it fails to verify if the string’s content is safely accessible from a background thread (i.e., whether it is an internalized or thin string).

Concurrently, the main thread can externalize these same non-internalized strings (e.g., via Blink’s ToBlinkString calling v8::String::MakeExternal). Because String::MakeExternal does not acquire the internalized_string_access mutex for non-internalized strings, it performs an in-place layout change without synchronization against the Maglev background thread reading the string.

Technical Details

In v8/src/maglev/maglev-graph-builder.cc, BuildStringConcat calls TryGetStringConstant, which returns a Handle<String> from a Constant node. Maglev passes the raw handle directly to compiler::utils::ConcatenateStrings, which eventually invokes String::WriteToFlat on the background thread.

While the background thread is reading the string, the main thread may execute String::MakeExternal on the same object. For non-internalized strings, MakeExternal avoids taking the internalized_string_access lock and proceeds to:

1. Update the object’s Map to an external string Map.
2. Initialize external pointer fields (overwriting existing internal fields).

If the string is a ConsString, the new 32-bit ExternalPointerHandle allocated for the resource_ field overwrites the first_ child pointer, as both are located at offset 12.

When the background thread executing WriteToFlat reads first = cons_string->first(), it reads this ExternalPointerHandle. Because the handle is shifted by 8 (kExternalPointerIndexShift), its lowest bit is 0, so V8 interprets it as a compressed Smi. Pointer decompression adds the V8 cage base to this value, resolving it to a pointer within the V8 sandbox.

If an attacker inflates the ExternalPointerTable (by allocating many external strings), they can control the offset of this handle and point it to an attacker-controlled object (e.g., an ArrayBuffer) within the sandbox, creating a fake String.

When WriteToFlat accesses first->length(), it reads the length from the attacker-controlled fake string. By providing a massive length, the attacker causes WriteToFlat to miscalculate second_length as a negative number. This triggers a logic path where WriteToFlat replaces its internal length bound with the massive length from the fake string, and loops to copy characters from the fake string.

This results in a massive CopyChars operation into a small sink buffer, causing an out-of-bounds write that can corrupt memory within the V8 sandbox.

Potential Reproduction Steps

Note: These are suggested steps based on static analysis, as this agent cannot execute code.

1. Create a non-internalized ConsString in old-space, large enough for in-place externalization (>= 24 bytes).
2. Store this string in a constant-tracked data field of a globally accessible object.
3. Define and warm up a JavaScript function that performs string concatenation using this constant field, triggering Maglev tier-up.
4. Concurrently, repeatedly allocate ExternalStrings to inflate the ExternalPointerTable so that the next handle points into an attacker-controlled ArrayBuffer containing a fake String payload (with a huge length).
5. Pass the non-internalized ConsString to a DOM sink (e.g., node.textContent = S) on the main thread to trigger v8::String::MakeExternal.
6. Maglev’s background thread races with MakeExternal, reads the overwritten first_ pointer, resolves it to the fake String, and performs an out-of-bounds write during WriteToFlat.

Suggested Fix

In MaglevGraphBuilder::TryGetStringConstant, restrict the returned string constants to those that are safe to read on a background thread. Similar to TurboFan’s StringCanSafelyBeRead, only return handles for strings where IsContentAccessible() or SupportedStringKind() is true (i.e., internalized or thin strings).

MaybeHandle<String> MaglevGraphBuilder::TryGetStringConstant(ValueNode* value) {
  if (Constant* constant = value->TryCast<Constant>()) {
    if (constant->object().IsString() && constant->object().IsContentAccessible()) {
      return handle(Cast<String>(*constant->object().object()), local_isolate());
    }
  } ...
}

Evaluated with Chrome root at commit: eca8648a4e1cdfdda68c495a6003059fed641955

Results so far have been promising, but there can be wrong deductions. If this proves to be a false positive, please close as WAI; data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.