# Modern attacks on the Chrome browser : optimizations and deoptimizations

DevFeed: [Modern attacks on the Chrome browser : optimizations and deoptimizations](<https://devfeed.tech/articles/modern-attacks-on-the-chrome-browser-optimizations-and-deoptimizations-39711.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2020/11/17/modern-attacks-on-the-chrome-browser-optimizations-and-deoptimizations/>)

Author: Jeremy "@\_\_x86" Fetiveau

Published: 2020-11-17T08:00:00Z

Content type: article

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Chrome](<https://devfeed.tech/topics/chrome.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [V8](<https://devfeed.tech/topics/v8.md>), [Hacking](<https://devfeed.tech/topics/hacking.md>)

Tags: [chrome](<https://devfeed.tech/tags/chrome.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [security](<https://devfeed.tech/tags/security.md>), [turbofan](<https://devfeed.tech/tags/turbofan.md>), [v8](<https://devfeed.tech/tags/v8.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

This article analyzes a security vulnerability in Chrome's V8 JavaScript engine, focusing on how TurboFan's simplified lowering phase mishandles deoptimization-related nodes. The bug can cause incorrect deoptimization data, allowing a fake object to be materialized and execution to continue with an arbitrary object pointer in an accumulator register.

## Source excerpt

Introduction Late 2019, I presented at an internal Azimuth Security conference some work on hacking Chrome through it's JavaScript engine. One of the topics I've been playing with at that time was deoptimization and so I discussed, among others, vulnerabilities in the deoptimizer. For my talk at InfiltrateCon 2020 in ...