In this blog, Manfred Paul, the winner of the Master of Pwn contest, details CVE-2024-2887, a type confusion bug in Google Chrome and Microsoft Edge (Chromium). This bug allows for the construction of powerful exploit primitives, including arbitrary reads, writes, and the addrOf() and fakeObj() primitives. These primitives are limited by the V8 memory sandbox, but they can be used to manipulate and fake most JavaScript objects. To escape the V8 memory sandbox, Paul exploited an integer underflow in the computation of a TypedArray’s length when backed by a growable SharedArrayBuffer. This underflow allows for access to the whole 64-bit address space, which can then be used to overwrite data anywhere in the process’s address space. A suitable target for overwrite is the compiled code of a WebAssembly module, which resides in an RWX page and can be overwritten with shellcode.