Agent skill · security · yaklang
browser-exploitation-v8
Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type confusion, incorrect bounds elimination, and V8 sandbox bypass to achieve renderer RCE and sandbox escape in Chrome/Chromium.
Why this skill is useful
Adds advanced exploitation techniques and patterns for V8 and Chrome that are not commonly known or documented.
What it needs
About 7k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Browser / V8 Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION: Expert V8/Chrome exploitation techniques. Covers V8 compilation pipeline, JIT type confusion, addrof/fakeobj primitives, ArrayBuffer corruption, WASM RWX pages, V8 sandbox (pointer compression), and Chrome sandbox escape overview. Distilled from ctf-wiki browser sections, Project Zero research, and CTF competition patterns. Base models often confuse V8 object representation details and miss the pointer compression barrier. 0. RELATED ROUTING sandbox-escape-techniques — Chrome renderer sandbox escape via IPC/Mojo heap-exploitation — general heap concepts applicable to V8 heap stack-overflow-and-rop — ROP concepts for native code execution after V8 escape binary-protection-bypass — ASLR/NX bypass in browser context Advanced Reference Load V8EXPLOITATIONPATTERNS.md when you need: Detailed exploitation patterns and code templates Heap layout manipulation and GC interaction V8 sandbox bypass techniques Object map confusion patterns --- 1. V8 ARCHITECTURE Compilation Pipeline Key V8 Concepts Concept Description --- --- Tagged pointers SMI (Small Integer): value << 1, HeapObject: ptr \ 1 Pointer compression V8 ≥ 8.0: objects addressed via 32-bit offset from cage base (4GB sandbox) Maps (Hidden Classes) Define object shape: property names, types, offsets Elements kinds Internal array type: PACKEDSMIELEMENTS, PACKEDDOUBLEELEMENTS, PACKEDELEMENTS, etc. Write barrier GC bookkeeping when heap pointers are written Garbage collection Orinoco GC: minor (Scavenge) and major (Mark-Compact) Object Representation (64-bit, pointer compression) --- 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/browser-exploitation-v8