https://algoatson.github.io/series/browser-exploitation/ The primitives and the bug are in hand; this is the escalation every JS-engine exploit ends with. Forge a TypedArray whose backing-store pointer you control, get read/write anywhere, then turn that into code execution — and the modern mitigations (the V8 sandbox, W^X JIT) that make the last step the hard one now. en Tue, 16 Jun 2026 02:47:53 +0000 https://algoatson.github.io/p/addrof-fakeobj-primitives/ https://algoatson.github.io/p/addrof-fakeobj-primitives/ Sun, 11 Jan 2026 00:00:00 +0000 pwnbrowser Every JavaScript-engine exploit converges on the same two primitives — leak the address of an object, and forge an object at an address. Build them once from a type confusion between a float array and an object array, and the rest of the exploit is mechanical. https://algoatson.github.io/p/jit-type-confusion/ https://algoatson.github.io/p/jit-type-confusion/ Tue, 13 Jan 2026 00:00:00 +0000 pwnbrowser The fastest path to the addrof/fakeobj primitives is a bug in the JIT itself. Convince the optimizer that a value has a type or range it doesn't, and it removes a bounds check it shouldn't have — handing you an out-of-bounds access in compiled, unguarded code. https://algoatson.github.io/p/oob-to-arbitrary-rw/ https://algoatson.github.io/p/oob-to-arbitrary-rw/ Fri, 16 Jan 2026 00:00:00 +0000 pwnbrowser The primitives and the bug are in hand; this is the escalation every JS-engine exploit ends with. Forge a TypedArray whose backing-store pointer you control, get read/write anywhere, then turn that into code execution — and the modern mitigations (the V8 sandbox, W^X JIT) that make the last step the hard one now.