## https://sploitus.com/exploit?id=AE4F5648-DB4F-5D38-8089-9DBE6A353D96
# CVE-2024-0519 โ RCA Research
Root cause analysis artifacts for CVE-2024-0519 (V8 out-of-bounds memory access, Chrome 120, exploited in the wild).
**Fix**: `e0f2a195d87c9a06685121e0e783efd92d030df3` โ Toon Verwaest, 2024-01-12
**V8 version studied**: 12.0.267.16 (`fbc4963bbff`), ARM64 macOS
---
## Files
| Path | Description |
|------|-------------|
| `harness/test-toctou-race.cc` | C++ cctest confirming the TOCTOU race window in `GetOwnFastDataPropertyFromHeap` |
| `harness/test-toctou-chain.cc` | C++ cctest demonstrating filler embedded as `HeapConstant` via the broker pipeline |
| `js/poc_325020448.js` | Zero-intrinsics JS trigger for chromium:325020448 (sibling bug, no public CVE) |
| `js/regress_325020448.js` | Official V8 regression test for chromium:325020448 (requires `--allow-natives-syntax`) |
| `patches/e0f2a195.md` | Fix commit metadata |
---
## Quick start
```bash
# Pre-patch d8 (V8 12.0.267.16, one commit before e0f2a195)
./d8 --concurrent-recompilation js/poc_325020448.js
# C++ cctests โ integrate into V8 cctest build, then:
./cctest test-toctou-race/ToctouRaceDeleteProperty
./cctest test-toctou-chain/EndToEndChainInstallNoPatch
./cctest test-toctou-chain/ConsequenceJSConsumption
```
See `BUILD.md` for build instructions.
---
## chromium:325020448
Sibling bug in the same `PropertyConstness::kConst` class โ constness not generalized across prototype transitions. Fixed by `496f467bb72` (Feb 19, 2024), five weeks after the CVE-2024-0519 fix. No public CVE assigned. Affects Chrome 122 (post-CVE-2024-0519 patch) through Chrome 123.
`js/poc_325020448.js` triggers it without any V8 natives flags.