PRIMARY TARGETS
===============

Current V8 main
  commit: 3110f734eda952e4795c484fb698d1ec7df51392
  artifact: exploit-main.js

First affected desktop Chrome Stable 127.0.6533.72 (Linux)
  embedded V8: 5c5f3d841901cb78a4e130d38d081d03f82f1e36
  V8 version: 12.7.224.16
  primitive artifact: chrome127-inline-local-primitives.html
  browser artifact: chrome127-full.html

Chrome Stable 149.0.7827.115
  embedded V8: 16ef80c1f5d3cfade812bd1743952a4cfd480a31
  d8 artifact: exploit-stable.js
  browser artifact: chrome-stable-full.html

INITIAL TEST TARGET
===================

V8 commit: 5068658e0b754814453e62dfe5898027ee052506
Artifact: exploit-default.js

REPRODUCTION
============

No V8 runtime flags are required.

  D8=/path/to/current-main/d8 ./reproduce_default.sh
  D8=/path/to/stable/d8 ./reproduce_stable.sh
  CHROME=/path/to/chrome-headless-shell ./reproduce_chrome_stable.sh
  CHROME=/path/to/chrome-127-headless-shell ./reproduce_chrome127.sh

The Chrome helper supplies --no-sandbox only for Chromium's outer process
sandbox in a local container. It supplies no --js-flags value or V8 flag.

The maintainer-facing security report is intentionally distributed next to,
not inside, this archive.

STABLE RELEASE BOUNDARY
=======================

evidence/oldest-affected-stable.txt establishes V8 12.7 / desktop Chrome
127.0.6533.72 (Linux; 127.0.6533.72/73 Windows/Mac) as the first affected
Stable release. The complete arbitrary-read/write proof passed 20/20 fresh
Chrome 127 renderer processes. Chrome 126's final Stable V8 revision is the
source-history negative control.
