Browser Exploitation V8

This one walks Claude through exploiting V8 and Chromium browser vulnerabilities, from JIT type confusion bugs to full renderer escape. It covers the standard attack chain: triggering TurboFan optimizations to hit type confusion or bounds check elimination bugs, building addrof and fakeobj primitives, corrupting ArrayBuffer backing stores for arbitrary read/write, and leveraging WASM RWX pages for code execution. The material is solid on V8 internals like pointer compression and the compilation pipeline, but stops short of Chrome sandbox escape details. You'd load this when writing exploits for browser CTF challenges or analyzing V8 CVEs where the base model would otherwise hallucinate object layouts or miss the pointer compression cage entirely.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill browser-exploitation-v8 --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Browser / V8 Exploitation — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert V8/Chrome exploitation techniques. Covers V8 compilation pipeline, JIT type confusion, addrof/fakeobj primitives, ArrayBuffer corruption, WASM RWX pages, V8 sandbox (pointer compression), and Chrome sandbox escape overview. Distilled from ctf-wiki browser sections, Project Zero research, and CTF competition patterns. Base models often confuse V8 object representation details and miss the pointer compression barrier.