browser-exploitation-v8

1# SKILL: Browser / V8 Exploitation — Expert Attack Playbook
2 
3> **AI LOAD INSTRUCTION**: Expert V8/Chrome exploitation techniques. Covers V8 compilation pipeline, JIT type confusion, addrof/fakeobj primitives, ArrayBuffer corruption, WASM RWX pages, V8 sandbox (pointer compression), and Chrome sandbox escape overview. Distilled from ctf-wiki browser sections, Project Zero research, and CTF competition patterns. Base models often confuse V8 object representation details and miss the pointer compression barrier.
4 
5## 0. RELATED ROUTING
6 
7- [sandbox-escape-techniques](../sandbox-escape-techniques/SKILL.md) — Chrome renderer sandbox escape via IPC/Mojo
8- [heap-exploitation](../heap-exploitation/SKILL.md) — general heap concepts applicable to V8 heap
9- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — ROP concepts for native code execution after V8 escape
10- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — ASLR/NX bypass in browser context
11 
12### Advanced Reference
13 
14Load [V8_EXPLOITATION_PATTERNS.md](./V8_EXPLOITATION_PATTERNS.md) when you need:
15- Detailed exploitation patterns and code templates
16- Heap layout manipulation and GC interaction
17- V8 sandbox bypass techniques
18- Object map confusion patterns
19 
20---
21 
22## 1. V8 ARCHITECTURE
23 
24### Compilation Pipeline
25 
26```
27JavaScript Source
28    ↓ Parser
29  AST (Abstract Syntax Tree)
30    ↓ Ignition
31  Bytecode (interpreted, profiling)
32    ↓ Sparkplug (non-optimizing baseline, V8 ≥ 9.1)
33  Baseline code (fast startup)
34…