PatchGap · Weakness Pattern
Garbage collector traversal and marking invariants violated
WP-GC-INVARIANT
UAFUninitializedMemoryRace
11 CVEs
11 mapped
CWE-416CWE-457CWE-362
2026-05 → 2026-09
V8’s heap-snapshot traversal, concurrent marking, and no-allocation scopes are violated by allocation during traversal, torn or misordered bitmap reads and writes, or stale raw pointers held across a GC. This lets the marker see partial state, miss strong fields, or free live objects. The outcome is a use-after-free or read of uninitialized memory.
Invariant
While a GC-critical operation runs, its invariant must hold: no allocation inside no-alloc traversal, mark-bit and object-start writes ordered so a concurrent marker never sees a pointer before its metadata, raw heap-object pointers not held across allocation, and every strong field covered exactly once.
Mechanism
Ordering bugs used a release store where the concurrent marker could observe a Member before its object-start bit (CVE-2026-10963) or a non-atomic dispatch/mark-bit store racing the marker (CVE-2026-79097, CVE-2026-14432). Allocation-during-traversal bugs reached boxing/property-lookup paths inside allocation-forbidden snapshot traversal (CVE-2026-14409, CVE-2026-17729), dropped the last live reference before a copy completed (CVE-2026-19556), or derived sizes from a GC-mutable IdentityMap (CVE-2026-9896). Others held a raw write pointer across a GC-triggering allocation (CVE-2026-11650), scanned an incomplete IterateBody omitting strong fields (CVE-2026-11050), or double-represented weak-map entries as both weak and ephemeron edges (CVE-2026-14415).
Fix shape
Use seq_cst or CAS-guarded stores so metadata and mark bits are visible in order to the concurrent marker, and thread AllowAllocation::kNo (or stable field offsets recomputed after allocation) so no-alloc traversal never allocates or holds a movable raw pointer.
CVEs in this pattern
2 components · V8, Bindings| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2026-95353 | UAF in Bindings | Bindings | chrome | Medium | 2026-09 | 🔧 |
| CVE-2026-19556 | UAF in V8 | V8 | chrome | High | 2026-08 | 🔧 |
| CVE-2026-79097 | UAF in V8 | V8 | chrome | Medium | 2026-08 | 🔧 |
| CVE-2026-17729 | UAF in V8 | V8 | chrome | Medium | 2026-07 | 🔧 |
| CVE-2026-10963 | IntegerOverflow in V8 | V8 | chrome | High | 2026-06 | 🔧 |
| CVE-2026-11050 | UAF in V8 | V8 | chrome | Medium | 2026-06 | 🔧 |
| CVE-2026-11650 | UAF in V8 | V8 | chrome | High | 2026-06 | 🔧 |
| CVE-2026-14409 | LogicError in V8 | V8 | chrome | Low | 2026-06 | 🔧 |
| CVE-2026-14415 | LogicError in V8 | V8 | chrome | Low | 2026-06 | 🔧 |
| CVE-2026-14432 | UAF in V8 | V8 | chrome | Medium | 2026-06 | 🔧 |
| CVE-2026-9896 | OOB in V8 | V8 | chrome | High | 2026-05 | 🔧 |
Hunt for siblings
Commit-scanner flags release-ordered bitmap stores, raw pointers spanning an Allocate call, and IterateBody edits; TSAN plus a snapshot/marking stress harness with concurrent allocation surfaces the torn reads and freed-live objects.
Mitigations that would catch this class
- Order object-start and mark-bit writes with seq_cst / CAS while marking is active
- Enforce AllowAllocation::kNo across snapshot and no-alloc traversal paths
- Recompute movable-object addresses from stable field offsets after any allocation