Everything I've written

V8's Maglev compiler has an inappropriate implementation in CanWriteElideBarrier, leading to a User-after-free vulnerability.

A logic bug in V8's Inline Cache subsystem that leads to type confusion via incorrect element kind handling for JSArgumentsObject, enabling hole leak and arbitrary read/write.

Continuing the V8 Exploitation journey — pwn.college Browser Exploitation levels 4–6: setLength OOB, offByOne abusing fast-properties, and functionMap type confusion.

New journey into V8 Exploitation — pwn.college Browser Exploitation levels 1–3: environment setup, ArrayRun, GetAddressOf / ArbRead32 / ArbWrite32, GetFakeObject, and JIT spraying.

You will see the world is so big when you learn heap.