# CVE-2021-37975: Chrome v8 garbage collector logic bug causing live objects to be collected

V8 garbage collector logic bug in ephemeron marking leaves live WeakMap entries unmarked, causing use-after-free exploitable for RCE in Chrome.

- Payout: Real-world hack
- Severity: high
- Program: Google Chrome
- Credited: Man Yue Mo, GitHub Security Lab
- Disclosed: 2021-09-30
- CVE: CVE-2021-37975
- Write-up quality: 9/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-37975.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-37975
- Tags: domain:browser impact:rce kind:incident platform:project-zero sev:high tech:chromium technique:source-review vuln:memory-corruption

**Target:** V8 JavaScript engine garbage collector
**Root cause:** In ProcessEphemerons, objects in the marking worklist may hold strong references to previously unreachable ephemerons in current_ephemerons; if the iteration exits before processing these newly alive ephemerons, they remain unmarked and get collected.
**Steps:**
1. Construct nested WeakMaps to create a chain of ephemerons where a key becomes reachable only after processing the worklist.
2. Trigger garbage collection with a large ArrayBuffer allocation to force marking.
3. Observe that a live object (v9) is collected, causing use-after-free when accessed.
**How found:** Manual auditing of garbage collector logic, focusing on ephemeron handling complexity; PoC requires specific WeakMap ordering and randomness, making fuzzing difficult.
**Exploitation:** Use the UAF on a TypedArray/ArrayBuffer to corrupt PartitionAlloc metadata, achieve arbitrary read/write, then overwrite WebAssembly function body in RWX memory to execute arbitrary code.
**Escalation:** Chain UAF with PartitionAlloc corruption and WASM RWX region to achieve RCE in the renderer.
**Insight:** When auditing garbage collectors, focus on ephemeron marking iterations: ensure that any object processed in the worklist triggers another iteration to re-evaluate previously unreachable ephemerons.