PatchGap · Weakness Pattern
Architecture codegen violates zero-extension and ABI invariants
WP-CODEGEN-ABI
OOBIntegerOverflowLogicError
11 CVEs
11 mapped
⚠️ 1 exploited in the wild
CWE-787CWE-190CWE-758
2025-07 → 2026-09
V8’s arm64/x64 code generation and low-level assembly mishandle zero-extension guarantees, callee-saved register widths, displacement overflow, register aliasing, and hidden clobbers. These break the ABI or representation invariants that later stages rely on, producing wrong code that leaves dirty high bits, unbalanced stacks, or clobbered registers. The downstream effect is out-of-bounds access or memory corruption.
Invariant
Emitted machine code must uphold the representation and ABI contracts it claims: a Word32 result actually has zero-extended high bits, callee-saved registers are preserved in full, address arithmetic cannot overflow, and no register or vector lane is silently clobbered across a call.
Mechanism
Several bugs conflated the Word32 representation with a proof of zero-extension, so values with dirty upper bits inherited a zero-extension guarantee (CVE-2025-10585, CVE-2026-5873, CVE-2026-95304), or used a self-move the assembler elides instead of a real zeroing move (CVE-2025-14766). Others performed unchecked 32-bit displacement addition that overflowed (CVE-2025-12441), compared arm64 registers with != instead of Aliases so a W-alias slipped through (CVE-2026-19151), modeled v8-v15 as fully callee-saved when AAPCS64 preserves only their lower 64 bits (CVE-2026-14407), reserved no veneer-pool margin (CVE-2025-7656), paired a fixed-arity builtin with kDontAdapt and zero formal params (CVE-2026-82072), relied on xmm contents persisting across separate asm volatile blocks without declaring clobbers (CVE-2026-87444), or built Crubit interop under a mismatched ABI mode (CVE-2026-87528).
Fix shape
Gate the zero-extension no-op lowering on the stronger ZeroExtendsWord32ToWord64 property rather than representation, and correct the ABI model (register aliasing, callee-saved widths, arity/adaptation, checked displacement, explicit clobbers) so emitted code honors its claims.
CVEs in this pattern
3 components · V8, Codecs, Rust| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2026-87444 | MemoryCorruption in Codecs | Codecs | chrome | High | 2026-09 | 🔧 |
| CVE-2026-87528 | TypeConfusion in Rust | Rust | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-95304 | OOB in V8 | V8 | chrome | High | 2026-09 | 🔧 |
| CVE-2026-19151 | UAF in V8 | V8 | chrome | High | 2026-08 | 🔧 |
| CVE-2026-82072 | OOB in V8 | V8 | chrome | Medium | 2026-07 | 🔧 |
| CVE-2026-14407 | LogicError in V8 | V8 | chrome | Medium | 2026-06 | 🔧 |
| CVE-2026-5873 | OOB in V8 | V8 | chrome | High | 2026-04 | 🔧 |
| CVE-2025-14766 | OOB in V8 | V8 | chrome | High | 2025-12 | 🔧 |
| CVE-2025-12441 | OOB in V8 | V8 | chrome | Medium | 2025-10 | 🔧 |
| CVE-2025-10585 | TypeConfusion in V8 | V8 | chrome | High | 2025-09 | ⚠️ 🔧 |
| CVE-2025-7656 | IntegerOverflow in V8 | V8 | chrome | High | 2025-07 | 🔧 |
Hunt for siblings
Commit-scanner flags codegen diffs touching zero-extension, Move/Mov, displacement folding, register comparison, or callee-saved masks; a differential codegen fuzzer comparing interpreter vs compiled results on arm64/x64 surfaces dirty-high-bit and clobber divergences.
Mitigations that would catch this class
- Require an explicit zero-extension property, not representation, before eliding extension moves
- Model register aliasing and callee-saved widths per the target ABI
- Guard displacement/offset folding against 32-bit overflow with signed-range checks