CVE-2026-85046 — V8 Maglev Type Confusion → Arbitrary R/W

Bug: Array.prototype.sort inlining — Maglev TryReduceArrayPrototypeSort
Reporter: Salvatore Gulizia (Serotav) | Fixed: Sep 2 2026 (Chrome ≥ 152.0.7977.82) | CVSS 8.8 | CWE-843

Chromium version: detecting...

Exploit chain:

1. Train Maglev with mixed element kinds ({PACKED_SMI, PACKED})
2. Comparator fill(0) migrates receiver map backward — post-sort CheckMaps only checks set membership
3. addrof — String() reads tagged pointers as Smis through the lied PACKED_SMI map
4. fakeobj — unshift() moves a tagged pointer through the Smi-kind path (no write barrier) → dangling old→young edge → minor GC frees the young object → spray reclaims its address with a fake JSArray
5. Arbitrary R/W — fake array (master) elements → victim−8, so master[0]/[1] alias the victim's map/elements header words

References:

• Serotav — When Sorting Leads To Confusion (this CVE)
• Serotav — From Regex to RCE (master/victim reclaim technique)
• Chrome Advisory
• NIST NVD