# Circumventing Chrome's hardening of typer bugs

DevFeed: [Circumventing Chrome's hardening of typer bugs](<https://devfeed.tech/articles/circumventing-chrome-s-hardening-of-typer-bugs-39709.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2019/05/09/circumventing-chromes-hardening-of-typer-bugs/>)

Author: Jeremy "\_\_x86" Fetiveau

Published: 2019-05-09T15:00:00Z

Content type: article

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [bug](<https://devfeed.tech/topics/bug.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [V8](<https://devfeed.tech/topics/v8.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Optimization](<https://devfeed.tech/topics/optimization.md>)

Tags: [bugs](<https://devfeed.tech/tags/bugs.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [optimization](<https://devfeed.tech/tags/optimization.md>), [turbofan](<https://devfeed.tech/tags/turbofan.md>), [v8](<https://devfeed.tech/tags/v8.md>)

## AI overview

This technical article explains how Chrome's TurboFan engine hardened bounds checks against typer bugs and discusses how those bugs can still be exploited in recent V8 versions. It examines the relevant lowering and linearization changes and presents a sample exploit for V8 7.5.0.

## Source excerpt

Introduction Some recent Chrome exploits were taking advantage of Bounds-Check-Elimination in order to get a R/W primitive from a TurboFan's typer bug (a bug that incorrectly computes type information during code optimization). Indeed during the simplified lowering phase when visiting a CheckBounds node if the engine can guarantee that ...