REPRODUCTION CASE

Tested with official Linux x64 ASAN Chromium 153.0.7979.0 at branch position 1670115.

1. Run python3 poc.py 8000.
2. Start the ASAN Chrome build with a fresh profile:

./chrome --headless=new \
  --user-data-dir=/path/to/fresh-profile \
  --no-first-run --disable-breakpad \
  --js-flags="--bytecode-old-time=0 --expose-gc" \
  http://127.0.0.1:8000/poc.html

3. Allow at least 150 seconds before declaring a miss. The first approximately 45-50 seconds are required for ServiceWorker code-cache setup.

For a stock-browser reproduction, omit --js-flags and allow at least six minutes for the first batch. After pre-caching, the PoC waits approximately 210 seconds for V8’s default 180-second bytecode age before racing. Each fallback batch requires the same aging period.

Stock d8 is not a valid reproducer: its --cache modes do not call StartConsumingCodeCache/ConsumeCodeCacheTask and never enter this BackgroundMergeTask configuration. ClusterFuzz should run the attachment in a release ASAN Chrome renderer (is_asan=true, is_debug=false).

VULNERABILITY DETAILS

V8’s default-enabled background code-cache merge reads a SharedFunctionInfo (SFI) while the renderer main thread publishes compiled state to that same cached SFI. HasOuterScopeInfo() can validate the old state, then GetOuterScopeInfo() reloads a new ScopeInfo with no outer-scope slot. In release builds, OuterScopeInfo() then reads the aliased unused_parameter_bits slot as a compressed ScopeInfo*.

JavaScript controls all 31 bits of that slot through formal-parameter usage. With pointer compression, the interpreted pointer is:

fake ScopeInfo = cage_base + (unused_parameter_bits << 1) - 1

Affected code path

Blink CacheStorage full code cache
 -> v8::ScriptCompiler::ConsumeCodeCacheTask
 -> BackgroundMergeTask::BeginMergeInBackground (worker)
 -> ConstantPoolPointerForwarder::RecordScopeInfos
 -> SharedFunctionInfo::{Has,Get}OuterScopeInfo

concurrently with

BackgroundMergeTask::CompleteMergeInForeground (main thread)
 -> SharedFunctionInfo::CopyFrom

Verified in V8 commit 968f19a8970f8d91702d86f0ec1522f3909781b7:

• shared-function-info-inl.h:713-732 and shared-function-info.cc:247-274: HasOuterScopeInfo() and GetOuterScopeInfo() load independently while CopyFrom() publishes the replacement fields separately.
• compiler.cc:2097-2136, 2458-2555, and 2593-2688: the background read races the foreground CopyFrom().
• scope-info-inl.h:137-169, 314-318, and scope-info.cc:487-496: a function scope without an outer scope aliases that slot with JavaScript-controlled unused_parameter_bits.
• compiler.cc:2165-2169, shared-function-info-inl.h:673-698, scope-info.cc:912-917, and scope-info-inl.h:268-275: the recorded pointer can reach a tagged field store through SetScopeInfo().

Race timeline

1. The worker reads the old empty scope_info in HasOuterScopeInfo().
2. The main thread runs CopyFrom(), publishing a real function ScopeInfo without an outer slot, then FeedbackMetadata; code is installed last.
3. The worker still observes the old lazy state but reads the new union and accepts it as an outer ScopeInfo; release-only checks do not reject the mismatch.
4. GetOuterScopeInfo() reloads the new function scope. Its OuterScopeInfo() access aliases unused_parameter_bits and returns the attacker-selected fake pointer.
5. UID processing later reaches a read or four-byte tagged write through that pointer.

The words are individually atomic, but the multi-field SFI transition is not. Acquire/release ordering provides no snapshot, lock, version check, or retry across the predicate and getter.

Browser trigger

The attachment pre-caches six source-distinct CacheStorage corpora in a ServiceWorker: 32 scripts per corpus and 3,600 functions per script, or 691,200 function definitions compiled and cached during installation. This takes approximately 50 seconds under the tested ASAN build and is required for reliable reproduction.

For each corpus the PoC serves byte-identical responses without side data to prime lazy compilation-cache entries, waits 210 seconds for default bytecode aging, then releases concurrent raw cached-script loads across same-origin frames. A missed batch therefore does not reuse the previous batch’s compilation-cache state.

For sanitizer triage, --bytecode-old-time=0 --expose-gc replaces only the 210-second aging delay. The PoC performs two explicit GCs before starting the same race.

Security impact

The controlled tagged store provide arbitrary read/write within the V8 heap.

VERSION

• Chrome ASAN Version: Chromium 153.0.7979.0, official Linux x64 ASAN archive at branch position 1670115
• Chromium commit: 75ccbb0e8a6fda6f1153ebfd357d1718da93679b
• V8: 15.3.8, commit 6a98814ab815ca70a2f78fe413b9012b81042957

BISECTION

A git bisect was run between current V8 6a98814ab815ca70a2f78fe413b9012b81042957 (bad) and parent commit 0c26903aa129bb300ae0701eb0826ebd535772de (good). The predicate marked a revision bad when the background merge contained both independent old_sfi->HasOuterScopeInfo() and old_sfi->GetOuterScopeInfo() accesses:

git bisect start 6a98814ab815ca70a2f78fe413b9012b81042957 \
  0c26903aa129bb300ae0701eb0826ebd535772de
git bisect run sh -c 'if git grep -q "old_sfi->HasOuterScopeInfo()" -- src/codegen/compiler.cc && git grep -q "old_sfi->GetOuterScopeInfo()" -- src/codegen/compiler.cc; then exit 1; fi; exit 0'

First bad commit:

9cbd134898ea79820e20a5a5a1a583b08e30698b
[compiler] Reuse ScopeInfos from previous compiles
Cr-Commit-Position: refs/heads/main@{#94966}

9cbd134898ea79820e20a5a5a1a583b08e30698b introduced RecordOuterScopeInfos() in ConstantPoolPointerForwarder and the predicate/getter pair used by BeginMergeInBackground. Its direct parent does not contain that worker-side pair. This is a source-level boundary; archived browser binaries were not runtime-bisected.

EXPECTED RESULT

All merges preserve a consistent SFI state, every generation completes without a renderer fault.

ACTUAL RESULT / CRASH STATE

Signal: SEGV_ACCERR

The ASAN build reports this as Received signal 11 SEGV_ACCERR, the corrupted compressed pointer resolves to an inaccessible address inside the V8 cage reservation.

ATTACHMENTS

• poc.py: self-contained local Chrome crash reproducer and HTTP server.

CREDIT INFORMATION

Reporter credit:

Salvatore Gulizia (nickname: Serotav)