Technical Details and Exploit Released for Chrome Remote Code Execution Flaw

A remote code execution vulnerability affecting Google Chrome’s WebAssembly engine has been publicly disclosed, along with a fully functional exploit, according to gbhackers. The flaw, identified during TyphoonPWN 2025, stems from a regression in the canonicalization logic for indexed reference types in WebAssembly and a novel sandbox bypass via JavaScript Promise Integration (JSPI).

Researchers from SSD Secure Disclosure demonstrated that by combining a nullability confusion bug with a birthday-attack–based hash collision technique, it is possible to gain arbitrary read/write primitives within the V8 sandbox and ultimately execute native code, with credit for the finding going to Seunghyun Lee (0x10n), who achieved first place in the Chrome RCE category.

Google has released an emergency patch reverting the faulty canonicalization logic and enforcing stricter JSPI stack-state checks, and the flaw affects all Chrome stable channel builds from M135 through M137 without proper null-equivalence checks, and M137+ for the JSPI bypass. Immediate updates from October 2025 or later are advised, alongside defensive measures such as monitoring anomalous WebAssembly usage.