# CVE-2022-4262: Incorrect Bytecode Generation by JavaScript Parser

V8 parser generated mismatched bytecode between initial parse and reparse of an arrow function with eval in a computed class property, causing type confusion and renderer RCE.

- Payout: Real-world hack
- Severity: high
- Program: Google Chrome
- Credited: Samuel Groß, V8 Security
- Disclosed: 2022-12-02
- CVE: CVE-2022-4262
- Write-up quality: 9/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2022/CVE-2022-4262.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2022-4262
- Tags: domain:browser impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:chromium technique:chained technique:source-review vuln:memory-corruption

**Target:** V8 JavaScript engine parser/bytecode generator
**Root cause:** Initial and re-parse passes handled a direct eval inside a computed class property with different strictness attributes, producing different bytecode; feedback vectors from the first bytecode were reused with the re-parsed bytecode.
**Steps:**
1. Craft arrow function with default arg being a class expression whose computed property calls eval: `(a = class b3 { [{c: eval()} ? 0 : (xy = 1)] }) => {}`
2. Invoke it in a loop to trigger bytecode aging/eviction via GC
3. Force recompilation by allocating large ArrayBuffers (`new ArrayBuffer(31*1024*1024*1024)`) to trigger GC
4. Reparse produces mismatched bytecode reusing stale feedback vectors, confusing PropertyCell with FeedbackCell
5. Alternatively enable `--no-lazy --stress-lazy-source-positions` to compile twice immediately and CHECK-fail on mismatch with simpler testcase `(a = class b3 { [eval()] }) => {}`
**How found:** Reporter Clement Lecigne (TAG) found it in the wild; PZ root-caused by noting V8 reparses functions after bytecode aging and that initial vs subsequent parses take different shortcuts, then identifying eval-in-computed-property strictness divergence. Suggested AST-level fuzzing and the --no-lazy/--stress-lazy-source-positions flags to surface mismatches.
**Exploitation:** Bytecode mismatch caused type confusion between a PropertyCell and FeedbackCell inside the V8 heap; typical flow builds arbitrary read/write primitive then shellcode execution. Used as renderer RCE in a chain against Samsung devices with CVE-2022-3038, CVE-2022-22706, CVE-2023-0266.
**Escalation:** Chained as renderer RCE with sandbox-escape/kernel CVEs (CVE-2022-3038, CVE-2022-22706, CVE-2023-0266) for full device compromise.
**Insight:** Enable `--no-lazy --stress-lazy-source-positions` (now auto-on with --fuzzing) to force double compilation and CHECK-fail on bytecode mismatch; target odd-but-valid syntax like eval inside computed class properties where lazy reparse takes shortcuts.