PatchGap · Weakness Pattern
WebAssembly subtype decision errors cause type confusion
WP-WASM-TC
TypeConfusion
9 CVEs
9 mapped
CWE-843
2024-12 → 2025-10
V8’s WebAssembly type system mis-decides subtype relations during type canonicalization, custom-descriptor subtyping, or ref.func exactness stamping. Comparisons that drop type-defining bits (mutability, nullability, exactness, indexedness) or that treat runtime-dependent descriptor identity as statically decidable let a value of one type be accepted where another is required. The result is a type confusion that downstream cast elimination and optimization logic trust.
Invariant
Two Wasm types are equal or in a subtype relation only when every type-defining bit matches (index, mutability, nullability, ref-kind, exactness) and, for custom descriptors and exact types, only when the relation is decidable at compile time rather than at runtime.
Mechanism
Canonicalization merged structurally distinct types by comparing only field types (omitting per-field mutability, CVE-2024-12692), only the type index (discarding nullability/ref-kind/exactness, CVE-2025-5959, CVE-2025-13228), or by inferring indexedness from kind() instead of has_index() (CVE-2024-12381); relative group-local indexes also escaped onto canonical objects (CVE-2024-12053). Separately, the subtyping oracle and codegen treated exact and custom-descriptor casts as statically decidable, wrongly eliminating checks or declaring failure branches unreachable (CVE-2025-13226, CVE-2025-13227, CVE-2025-13230), and ref.func stamped imported functions as exact when imports only guarantee subtyping (CVE-2025-13229).
Fix shape
Thread the full CanonicalValueType through comparisons and require every type-defining bit to match, and exclude custom-descriptor and exact cases from static subtyping so runtime-dependent checks are preserved rather than optimized away.
CVEs in this pattern
1 component · V8| CVE | What | Component | Vendor | Severity | Month | |
|---|---|---|---|---|---|---|
| CVE-2025-13226 | TypeConfusion in V8 | V8 | chrome | High | 2025-10 | 🔧 |
| CVE-2025-13227 | TypeConfusion in V8 | V8 | chrome | High | 2025-10 | 🔧 |
| CVE-2025-13228 | TypeConfusion in V8 | V8 | chrome | High | 2025-10 | 🔧 |
| CVE-2025-13229 | TypeConfusion in V8 | V8 | chrome | High | 2025-10 | 🔧 |
| CVE-2025-13230 | TypeConfusion in V8 | V8 | chrome | High | 2025-10 | 🔧 |
| CVE-2025-5959 | TypeConfusion in V8 | V8 | chrome | High | 2025-06 | 🔧 |
| CVE-2024-12053 | TypeConfusion in V8 | V8 | chrome | High | 2024-12 | 🔧 |
| CVE-2024-12381 | TypeConfusion in V8 | V8 | chrome | High | 2024-12 | 🔧 |
| CVE-2024-12692 | TypeConfusion in V8 | V8 | chrome | High | 2024-12 | 🔧 |
Hunt for siblings
Commit-scanner flags subtyping/canonicalization code that compares type_index alone or branches on kind() rather than has_index()/is_exact(); a Wasm type-generation fuzzer with custom descriptors and imports catches accepted-but-invalid casts.
Mitigations that would catch this class
- Compare complete canonical type descriptors, never a bare type index
- Gate cast elimination and branch-reachability on decidability, excluding custom descriptors and exact types
- Restrict exact stamping to non-imported references