Unsound representation selection and phi untagging in V8 optimizers

TypeConfusion 9 CVEs 9 mapped ⚠️ 2 exploited in the wild CWE-843 2024-12 → 2026-07

In Maglev and Turboshaft the optimizer chooses machine representations and untagging/retagging conversions for SSA values, especially loop and merge phis. When that selection records or preserves the wrong tag (Smi vs HeapNumber/Float64) or drops a required heap-object check, a value is later read at a type it cannot hold. For a defender this is a compiler-level type confusion that survives the source-level checks and manifests as miscompiled machine code.

Invariant

Every use of an optimized SSA value must observe a tag/representation the value can actually hold at runtime, and any heap-object or Smi use requirement must be recorded against the actual defining node before its conversion is chosen.

Mechanism

The members retag or canonicalize phis and cached conversions without soundly propagating use requirements: a backedge phi input is retagged before its predecessor is visited (CVE-2024-12693, CVE-2026-3910), a cached tagged conversion defaults to kForceHeapNumber so a BuildCheckSmi-guarded value stays a HeapNumber (CVE-2025-12727), and Smi/heap-object use requirements are recorded on the wrong path or ignore the actual node (CVE-2026-4447, CVE-2026-4461, CVE-2026-5871, CVE-2026-7337). Others copy field values by raw index discarding Representation (CVE-2025-13223) or treat IsUsedAsWord32 as sufficient while ignoring check_safe_integer (CVE-2026-15903). The result is a value reasoned about with the wrong machine type.

Fix shape

Fixes record the true use requirement against the defining node (SetUseRequiresHeapObject, kCanonicalizeSmi default), defer backedge inputs until their predecessor is processed, or add the missing coexisting condition to the truncation/retagging decision.

CVEs in this pattern

1 component · V8

CVE	What	Component	Vendor	Severity	Month
CVE-2026-15903	OOB in V8	V8	chrome	High	2026-07	🔧
CVE-2026-5871	TypeConfusion in V8	V8	chrome	High	2026-04	🔧
CVE-2026-7337	TypeConfusion in V8	V8	chrome	High	2026-04	🔧
CVE-2026-3910	LogicError in V8	V8	chrome	High	2026-03	⚠️ 🔧
CVE-2026-4447	LogicError in V8	V8	chrome	High	2026-03	🔧
CVE-2026-4461	LogicError in V8	V8	chrome	High	2026-03	🔧
CVE-2025-12727	LogicError in V8	V8	chrome	High	2025-11	🔧
CVE-2025-13223	TypeConfusion in V8	V8	chrome	High	2025-11	⚠️ 🔧
CVE-2024-12693	OOB in V8	V8	chrome	High	2024-12	🔧

Hunt for siblings

Auditors and commit scanners look for Maglev/Turboshaft phi untagging or representation-selection code that retags or canonicalizes based on value-equivalence, IsUsedAsWord32, or a default conversion, without checking a coexisting heap-object/Smi/safe-integer requirement on the actual node.

Mitigations that would catch this class

Record heap-object and Smi use requirements on the actual defining node and re-verify them after every phi untagging or canonicalization pass.
Default cached tagged conversions to canonicalize Smis rather than force HeapNumber, and never treat value-equivalence as proof of tagging.
Process loop backedge phi inputs only after their predecessor block, and add representation-consistency assertions in debug builds.

← All weakness patterns