Abstract

While object allocations in the V8 heap generally follows a straightforward linear pattern, making it easy to calculate offsets between objects, it is however, non trivial to obtain addresses of objects or controlled data without a sufficiently powerful bug, such as an out-of-bounds access in V8, or a separate info leak bug. This can make exploiting memory corruption bugs in blink and third party libraries, such as ANGLE and SQLite, much more difficult. While in the post spectre/meltdown world, the entire address space within the renderer process is, in principle, readable from malicious Javascript [1] and there are also other techniques, such as those detailed in this ticket [2], that can be used, object addresses can in fact be found in a much simpler way.

In this talk I'll examine some details of the V8 heap initialization and the randomness that is involved, showing just how easy it can be to predict addresses of objects in V8.

1. https://v8.dev/blog/spectre#site-isolation
2. https://bugs.chromium.org/p/chromium/issues/detail?id=1144662