The Hat Trick: Exploit Chrome Twice from Runtime to JIT

With updates to the JS standard and requirements for higher runtime efficiency, Google's JS engine V8 has implemented newer features such as built-in functions like Promise.any and the Maglev mid-tier compiler.

Maglev is a compilation optimization layer in V8 that is situated between Sparkplug and Turbofan in order to accelerate the optimization and compilation of JS code. However, due to the involvement of compilation and optimization-related mechanisms in the Maglev compilation layer, deep and complex code logic can hide undetected …

accelerate chrome compiler efficiency engine exploit features functions google higher jit optimization order requirements runtime standard updates