browser-exploitation-v8
This skill covers advanced V8 and Chrome exploitation methods, including JIT type confusion, incorrect bounds elimination, and pointer compression bypass. Learn to build addrof and fakeobj primitives, corrupt ArrayBuffer backing stores, and leverage WASM RWX pages for renderer RCE and sandbox escape.
Browser Exploitation V8 teaches V8 JIT type confusion, bounds elimination, and Chrome sandbox escape techniques.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Browser Exploitation V8 teaches V8 JIT type confusion, bounds elimination, and Chrome sandbox escape techniques. This skill covers advanced V8 and Chrome exploitation methods, including JIT type confusion, incorrect bounds elimination, and pointer compression bypass. Learn to build addrof and fakeobj primitives, corrupt ArrayBuffer backing stores, and leverage WASM RWX pages for renderer RCE and sandbox escape.
Use it when
- browser-exploitation-v8 teaches how to construct arbitrary read/write primitives from type confusion vulnerabilities in V8's JIT compiler.
- browser-exploitation-v8 covers pointer compression bypass techniques that allow attackers to circumvent V8's sandbox architecture.
Verify before relying
Read SKILL.md below before installing (2 files). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/browser-exploitation-v8 · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What V8 exploitation techniques does browser-exploitation-v8 teach?
browser-exploitation-v8 covers advanced V8 and Chrome exploitation methods, including JIT type confusion, incorrect bounds elimination, and pointer compression bypass. The skill focuses on building addrof and fakeobj primitives from type confusion vulnerabilities, corrupting ArrayBuffer backing stores, and leveraging WASM RWX pages for renderer RCE and sandbox escape.
How can I build arbitrary read/write primitives using browser-exploitation-v8?
browser-exploitation-v8 teaches how to construct arbitrary read/write primitives from type confusion vulnerabilities in V8's JIT compiler. These primitives form the foundation for memory corruption attacks, enabling you to read and write arbitrary memory locations needed for further exploitation of the browser sandbox.
What is pointer compression V8 sandbox bypass in browser-exploitation-v8?
browser-exploitation-v8 covers pointer compression bypass techniques that allow attackers to circumvent V8's sandbox architecture. Understanding pointer compression mechanisms and their weaknesses is critical for developing reliable exploits that can escape the renderer process and achieve full browser compromise.
How does browser-exploitation-v8 explain renderer RCE via ArrayBuffer?
browser-exploitation-v8 demonstrates how to achieve renderer RCE by corrupting ArrayBuffer backing stores through type confusion and memory corruption primitives. By manipulating ArrayBuffer objects, attackers can gain arbitrary read/write access, which can then be leveraged to execute shellcode and compromise the renderer process.
What WebAssembly exploitation methods are covered in browser-exploitation-v8?
browser-exploitation-v8 teaches how to exploit WASM memory corruption to create RWX pages for shellcode execution in Chrome. By combining V8 memory corruption primitives with WebAssembly capabilities, attackers can bypass code execution restrictions and achieve full renderer compromise.
Does browser-exploitation-v8 cover Chrome IPC and Mojo exploitation?
browser-exploitation-v8 includes coverage of Chrome IPC and Mojo exploitation for full browser process compromise. This represents advanced attack surface beyond the renderer, enabling attackers to escalate from sandbox escape to complete browser takeover through inter-process communication vulnerabilities.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Browser / V8 Exploitation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert V8/Chrome exploitation techniques. Covers V8 compilation pipeline, JIT type confusion, addrof/fakeobj primitives, ArrayBuffer corruption, WASM RWX pages, V8 sandbox (pointer compression), and Chrome sandbox escape overview. Distilled from ctf-wiki browser sections, Project Zero research, and CTF competition patterns. Base models often confuse V8 object representation details and miss the pointer compression barrier.
0. RELATED ROUTING
- sandbox-escape-techniques — Chrome renderer sandbox escape via IPC/Mojo
- heap-exploitation — general heap concepts applicable to V8 heap
-
stack-overflow-and-rop — ROP concepts for native code execution after V8 escape
(truncated - see the full file via the links below)
File tree — 2 files
skills/browser-exploitation-v8/SKILL.md
skills/browser-exploitation-v8/V8_EXPLOITATION_PATTERNS.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn V8/Chrome exploitation techniques for JIT bugs and sandbox escape”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Weaponize client-side browser vulnerabilities into full host compromise by chaining JS-engine bugs through multiple sandbox layers. This skill covers V8 and JavaScriptCore exploitation, heap-sandbox escape techniques, OS-sandbox bypass via Mojo IPC and GPU processes, and Electron/webview misconfigurations. Includes scripts, references, and OPSEC guidance for assembling 1-click drive-by RCE delivery.
This skill covers format string exploitation from vulnerability identification through advanced attack chains. Learn to read stack memory with %p, perform arbitrary writes using %n variants, leak canaries and ASLR offsets, and overwrite GOT entries or hooks for code execution. Includes pwntools automation and blind exploitation techniques.
Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak → read/write → control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry.
A comprehensive playbook for escaping multiple sandbox types encountered in CTF competitions and security research. Covers Python pyjail breakouts, Lua environment bypasses, seccomp filter evasion, chroot jailbreaks, container escape vectors, browser sandbox circumvention, and namespace isolation techniques. Includes decision trees and code patterns for each sandbox variant.
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.
Master the identification and circumvention of modern binary protections including ASLR, PIE, NX/DEP, stack canaries, RELRO, FORTIFY_SOURCE, CET, and MTE. This playbook pairs each protection mechanism with its bypass methods and required primitives, drawing from real-world exploitation and CTF techniques. Learn information leaks, ROP chains, ret2libc, and alternative targeting strategies when standard approaches are blocked.
More skills shellcode-dev (MIT) · edr-evasion (MIT) · malware-analysis (MIT)