PatchGap
PatchGap · Weakness Pattern

Broken deopt/OSR bookkeeping and unsound escape analysis

WP-OPT-DEOPT-ESCAPE
TypeConfusionUAFIntegerOverflowLogicError 12 CVEs 12 mapped CWE-843CWE-416CWE-190 2025-03 → 2026-09

V8’s optimizers rely on precise bookkeeping across deoptimization, on-stack replacement, escape analysis, and allocation folding: which values stay live, which allocations escape, and which code is on the stack. When that accounting undercounts uses, keeps an escaping allocation virtual, folds into a stale block, or picks the wrong OSR/deopt target, a stale or type-confused value is materialized. For a defender this is a class of miscompiles rooted in liveness and escape/OSR state, not in a single operation.

Invariant
An allocation may stay virtual only if it and everything reachable from it truly does not escape; every value needed on a deopt or OSR frame must be counted live at frame-creation time; and deopt/OSR must always act on the code and target actually on the stack.

Mechanism

Members undercount deopt liveness by counting uses at scope-creation instead of deopt-frame creation or in a recursive continuation wrapper (CVE-2026-5862, CVE-2026-5863), keep escaping objects virtual with a non-transitive escape test (CVE-2026-6363), and leave allocation-folding state alive when inlining ends in an unconditional deopt (CVE-2025-1920). Others mispick or fail to invalidate OSR/deopt targets after unwinding (CVE-2026-78956, CVE-2026-87489, CVE-2026-17989, CVE-2026-78910), model an iteration’s value/done pair inconsistently on deopt (CVE-2026-14383), or overflow a phi/GeneratorStore input count that is validated too late (CVE-2025-10892, CVE-2026-2649).

Fix shape

Fixes count deopt uses per frame, apply the transitive escape test uniformly, move allocation-block/OSR-target clearing onto the deopt/exception path, supply the actual on-stack code to DeoptimizeFunction, and validate input-count bounds before the truncated value is stored.

CVEs in this pattern

1 component · V8
CVEWhatComponentVendorSeverityMonth
CVE-2026-87489 MemoryCorruption in V8 V8 chrome Low 2026-09 🔧
CVE-2026-102321 TypeConfusion in V8 V8 chrome High 2026-09 🔧
CVE-2026-78910 OOB in V8 V8 chrome Medium 2026-08 🔧
CVE-2026-78956 TypeConfusion in V8 V8 chrome Low 2026-08 🔧
CVE-2026-17989 TypeConfusion in V8 V8 chrome Low 2026-07 🔧
CVE-2026-14383 LogicError in V8 V8 chrome Medium 2026-06 🔧
CVE-2026-5862 LogicError in V8 V8 chrome High 2026-04 🔧
CVE-2026-5863 LogicError in V8 V8 chrome High 2026-04 🔧
CVE-2026-6363 TypeConfusion in V8 V8 chrome Medium 2026-04 🔧
CVE-2026-2649 IntegerOverflow in V8 V8 chrome High 2026-02 🔧
CVE-2025-10892 IntegerOverflow in V8 V8 chrome High 2025-09 🔧
CVE-2025-1920 TypeConfusion in V8 V8 chrome High 2025-03 🔧

Hunt for siblings

Auditors and commit scanners look for escape analysis using non-transitive escape tests, deopt/OSR bookkeeping that counts uses or clears targets on the wrong path, and input-count computations derived from function-controlled values without an early kMaxInputs bound.

Mitigations that would catch this class

  • Count deopt/OSR frame liveness at frame-creation time and use a transitive escape test before keeping any allocation virtual.
  • Reset OSR and allocation-folding state on deopt and exception paths, and deoptimize the exact Code found on the stack.
  • Bound phi and GeneratorStore input counts against Node::kMaxInputs before the count is stored, not in a later constructor body.
← All weakness patterns