# CVE-2022-1364: Inconsistent Object Materialization in V8

V8 escape analysis dematerialized an ArgumentsObject while keeping its backing store, so repeated stack materialization created two ArgumentsObjects sharing one backing store, leaking the hole value.

- Payout: Real-world hack
- Severity: high
- Program: Google Chrome
- Credited: Samuel Groß, V8 Security
- Disclosed: 2022-04-14
- CVE: CVE-2022-1364
- Write-up quality: 9/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-1364.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-1364
- Tags: domain:browser impact:rce kind:incident platform:project-zero sev:high tech:chromium technique:chained technique:source-review vuln:info-disclosure vuln:memory-corruption

**Target:** V8 JavaScript engine (Chrome renderer)
**Root cause:** Escape analysis dematerialized an ArgumentsObject but kept its FixedArray backing store alive (used by a dynamic LoadElement), and OptimizedFrame::Summarize materializes `this` multiple times without deoptimizing, producing multiple ArgumentsObjects sharing one backing store.
**Steps:**
1. Build optimized function where `arguments` is passed as `this` to a call and backing store is used via `return arguments[a]` with dynamic index, preventing backing store dematerialization.
2. Trigger stack capture via `Error.prepareStackTrace` returning `B[z].getThis()` inside the optimized function to materialize `this` twice.
3. Observe two distinct ArgumentsObjects (`e.M !== e.C`) sharing the same backing store.
4. `delete` an entry on one object (PACKED→HOLEY), read same index on the other (still PACKED) to leak the internal hole value.
**How found:** Analysis of an in-the-wild exploit sample; root cause traced to escape analysis/materialization interaction. Text suggests it could have been found as a variant of CVE-2021-21195 or via differential fuzzing.
**Exploitation:** Leak the V8 hole value via shared backing store, then leverage hole access for memory corruption as in crbug.com/1263462 (CVE-2021-38003); used as part of a likely exploit chain against Chrome.
**Escalation:** Hole leak primitive chained to memory corruption following the CVE-2021-38003 exploit flow.
**Insight:** When escape analysis dematerializes an object but keeps a sub-allocation (backing store) alive, look for paths that materialize the same activation multiple times (stack capture via Error.prepareStackTrace/getThis) to create aliased objects violating no-shared-backing-store invariants.