Loading vulnerability…
CVE-2023-2033 is a type confusion vulnerability in the V8 JavaScript engine in Google Chrome before version 112.0.5615.121. A remote attacker can use a crafted HTML page to potentially corrupt heap memory. Exploitation can yield address-disclosure and read/write primitives within the V8 heap. Native code execution requires overcoming the V8 sandbox boundary; an associated WebAssembly sandbox-bypass technique abuses the WasmIndirectFunctionTable targets pointer to obtain writes outside that boundary. The vulnerability has been exploited in the wild, including in AliGater malware-delivery chains and exploitation associated with Intellexa/Cytrox.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a proof-of-concept exploit for CVE-2023-2033, a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. The main file, 'exploit.js', is a standalone JavaScript exploit that must be run in a specifically built version of the V8 d8 shell (commit f7a3499f6d7e50b227a17d2bbd96e4b59a261d3c). The exploit leverages a bug in V8's Turbofan JIT compiler's type system, allowing the attacker to create arbitrary memory read and write primitives by manipulating JavaScript arrays and objects. The exploit demonstrates the ability to leak addresses and craft fake objects, which are essential steps toward achieving arbitrary code execution. The repository also includes a patch file, 'fix_torque_build_error.patch', which is only needed to resolve a build issue in V8 and is not related to the vulnerability. The README is minimal and simply identifies the CVE. No network endpoints or external services are targeted; the exploit is purely local and requires manual setup of the vulnerable environment.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A use-after-free vulnerability in V8 JavaScript engine in Google Chrome, exploited by Predator spyware.
A vulnerability in Chrome's V8 JavaScript engine exploited by AliGater against outdated browsers. The attack uses a WebAssembly module to manipulate memory and execute native shellcode within the Chrome process, initiating a multistage infection chain that delivers Lumma stealer.
A Google Chrome zero-day discovered in 2023 and associated with Intellexa/Cytrox and Predator spyware. The content does not describe its technical mechanism.
An in-the-wild V8 vulnerability that provides initial exploitation primitives inside the V8 heap, but requires a separate V8 sandbox escape to achieve full code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.