vulns.co
/
GKData.io MCP

MEMemory safety and parser contracts · 2 min read

V8 optimized object handling retained invalid type assumptions

One V8 type-consistency report earned a USD 50,000 award.

Read the primary source MEMemory safety and parser contractsReviewed 2026-10-02

Root cause

Optimized object handling could retain invalid type assumptions, producing a type-consistency failure.

Demonstrated impact

Memory read/write was possible; broader code execution required an additional boundary failure.

Lessons for review

  • Optimized execution must invalidate cached assumptions when object state changes and handle all supported object families consistently.
  • Distinguish issue-status fixes from stable-release availability.

Award and evidence

USD 50,000Bug Bounty · Vendor Confirmed

Case notices use $; USD is contextual from the official Chromium program source. No currency conversion or cash-receipt claim.

Public Chromium issue award/date metadata read in the cloud browser; official release corroborates exact per-issue total and CVE. Researcher advisory independently reviewed.

  • Case notices use dollar notation; USD denomination relies on official Chromium program context.
  • Award decisions are established; payment completion is not.
  • Fixed status and publicly available stable release are separate dates.
  • Release list revised November 17, 2025; it identifies the newly added entries separately as CVE-2025-13226 through 13230. This record retains the October 28 release disclosure.

Recorded timeline

Published
2026-03-17explicit · Detailed researcher advisory; public issue access opened January 13, 2026, after the October 2025 vendor notice.
Public Disclosure
2025-10-28explicit · Vendor release disclosure; full issue access was enabled later.
Reported
2025-09-26explicit
Awarded
2025-10-14explicit
Fixed
2025-10-28explicit · Documented stable release; issue was marked Fixed 2025-10-06. Backport availability may differ.
Award Announced
2025-10-28explicit · Per-issue reward listed in the public release notice.

Related visual models

Untrusted input is parsed with memory safety and limited privileges. A bounded typed result still requires an independent meaning and authorization check before any scoped operation; failed checks reject the request.

Conceptual model Diagram

Parsing safety and action authority

Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.

Reviewed 2026-10-02Read

Sources and provenance

  1. Chromium issue 447613211 Google Chromium security team · reviewed 2026-10-02
  2. Chrome Stable Channel Update for Desktop, 2025-10-28 Google Chrome team · reviewed 2026-10-02
  3. Security rewards at Google: Two MEEELLION Dollars Later Chromium team · reviewed 2026-10-02
  4. GHSL-2025-114: Chromium V8 advisory Man Yue Mo / GitHub Security Lab · reviewed 2026-10-02

Record reviewed 2026-10-02. Snapshot 53796974ace8. Open the complete JSON contract.

GitHub snapshot 2026-10-04

53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software