# CVE-2021-30632: Chrome Turbofan Type confusion in Global property access

Turbofan failed to deoptimize global-property stores when the property cell's map was unstable, causing type confusion and OOB read/write in V8.

- Payout: Real-world hack
- Severity: high
- Program: Google Chrome
- Credited: Man Yue Mo, GitHub Security Lab
- Disclosed: 2021-09-13
- CVE: CVE-2021-30632
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-30632.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-30632
- Tags: domain:browser impact:rce kind:incident platform:project-zero sev:high tech:chromium technique:chained technique:source-review vuln:dos vuln:memory-corruption

**Target:** V8 Turbofan JIT global property access
**Root cause:** Optimized code storing global properties with kConstantType only deoptimized when the property cell value's map was stable; an in-place map change left the compiled store with a stale map assumption, so a later store of an old-map object caused type confusion.
**Steps:**
1. Define `store(y){x=y}` and `load(){return x.b}` with global `x` holding an object.
2. Warm up `store` with objects x1,x2, then add `x1.b=1` and optimize `store` while x's map is unstable.
3. Optimize `load` after `x.b=1` so it assumes x has the new map with property b.
4. Call `store(x3)` with an old-map object; `load()` then reads `b` from a mismatched map, yielding type confusion.
5. Replace objects with arrays of differing element types to obtain OOB read/write.
**How found:** Author noted the code comment admitting the store goes through despite an unstable map, differing from runtime behavior; after seeing release notes flagging it exploitable, spent hours constructing two interacting optimized functions with objects in different map-transition stages.
**Exploitation:** Relative read/write from the type confusion is used to corrupt a TypedArray for absolute read/write, then overwrite a WebAssembly function body in an RWX region with shellcode and call it.
**Escalation:** Chained with sandbox escape CVE-2021-30633 (patched same day, same anonymous reporter) to fully compromise Chrome.
**Insight:** When a JIT bails on unstable maps, check whether any path (here kConstantType global stores) deliberately skips the stability dependency; the mismatch between runtime cell-type transition and generated-code assumptions is the exploitable gap.