Chrome · V8
CVE-2026-78938
Type Confusion in V8
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/heap/setup-heap-internal.cc
Patch
From 6f81b563fa9e3fde15412b0e3ab2b1e2b7e6d0d7 Mon Sep 17 00:00:00 2001 From: pthier <[email protected]> Date: Fri, 21 Aug 2026 11:58:35 +0200 Subject: [PATCH] Native builtins are strict There was a discrepancy between native builtins registered in bootstrapper vs setup-heap-internal. The former marked the builtins as strict, whereas the latter didn't. Mark builtins as strict also in setup-heap-internal. Fixed: 545767601 Change-Id: Ida4da4bdcfe7dcfdc16f1da0ec022a65cf853ce8 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8274474 Reviewed-by: Leszek Swirski <[email protected]> Commit-Queue: Patrick Thier <[email protected]> Cr-Commit-Position: refs/heads/main@{#109425} --- diff --git a/src/heap/setup-heap-internal.cc b/src/heap/setup-heap-internal.cc index b6d23f6..e7b27b1 100644 --- a/src/heap/setup-heap-internal.cc +++ b/src/heap/setup-heap-internal.cc @@ -75,6 +75,7 @@ DirectHandle<SharedFunctionInfo> shared = isolate->factory()->NewSharedFunctionInfoForBuiltin( isolate->factory()->empty_string(), builtin, len, kAdapt, kind); + shared->set_language_mode(LanguageMode::kStrict); return shared; }
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page