Browser JIT Exploitation 2026: How Glasswing Weaponized Just-In-Time Compilation

Traditional JavaScript interpreters execute bytecode directly, one instruction at a time. This is safe but slow. JIT compilers observe which code paths are executed frequently (called hot paths) and compile them to native machine code. The native code is cached and reused on subsequent calls, making it orders of magnitude faster. The complexity arises from type speculation. JavaScript variables have no declared type. A variable can hold an integer on one call and a string on the next. The JIT compiler bets on a type (for example, assuming a variable is always a 32-bit integer) and emits native code optimized for that type. If the bet is wrong at runtime, the JIT deoptimizes: it throws away the compiled code and falls back to the interpreter. This speculate-and-deoptimize cycle is the attack surface. If an attacker can construct JavaScript that causes the JIT to speculate incorrectly, then execute code that violates the speculation without triggering deoptimization, they can cause the JIT to read or write memory based on wrong type assumptions.

Type confusion occurs when the JIT compiler is convinced that an object is of type A, but the object is actually of type B. In memory terms, types determine how fields are laid out and what sizes they occupy. If the JIT reads a field from object B using type A's field offsets, it may read memory that is adjacent to the object rather than part of it. With careful setup, the attacker can place a controlled object at the memory location the confused read will hit. Reading or writing through that confusion gives the attacker an out-of-bounds access primitive. From an OOB read/write, a skilled exploit developer builds a stronger primitive: often an addrof primitive (read the memory address of any object) and a fakeobj primitive (inject a fake object at any address). With these two, the attacker can craft a fake ArrayBuffer with an attacker-controlled backing store pointer, giving them arbitrary read and write across the process address space. At that point, code execution typically involves writing shellcode or a ROP chain to a known-executable memory region and hijacking control flow.

Human security researchers find JIT bugs through a combination of source code review, differential fuzzing, and deep knowledge of engine internals accumulated over years of study. Mythos approaches the same problem through a different mechanism. It reads the JIT compiler source code and reasons about the invariants the compiler relies on. It then constructs JavaScript programs that satisfy all the surface-level invariants (so the JIT does not immediately deoptimize) while violating a deeper invariant at a specific point in the execution. This is closer to symbolic reasoning over code paths than traditional fuzzing. The result is targeted, minimal JavaScript that reliably triggers the bug rather than the large, noisy test cases that fuzzing typically produces. Mythos's ExploitBench result of 21 out of 41 V8 ACEs (with no other AI model above zero) quantifies this capability in benchmark conditions. The Glasswing JIT CVE applies the same capability to production browser code.

Understand the full chain so you can assess the real risk. Step one: trigger the type confusion with a crafted JavaScript program. Step two: use the OOB access to build addrof and fakeobj primitives. Step three: construct a fake ArrayBuffer with a controlled backing store pointer. Step four: use the fake ArrayBuffer for arbitrary read/write across the renderer process. Step five: identify and overwrite a code pointer (such as a function pointer in a V8 internal object or a return address on the stack, bypassing stack canaries via arbitrary write). Step six: execute the payload inside the renderer process. At this stage, the attacker has code execution in the browser renderer, which is sandboxed. A full browser compromise typically requires a second vulnerability (a sandbox escape) to escape the renderer. The Glasswing JIT finding focuses on the renderer-level arbitrary code execution step.

The Glasswing finding is under coordinated disclosure embargo as of July 5, 2026. Browser vendors have been notified through Anthropic's standard coordinated disclosure process. The JIT type confusion class is not unique to any single engine: V8 (Chrome, Edge, Node.js, Deno), SpiderMonkey (Firefox), and JavaScriptCore (Safari, WebKit) all implement JIT compilation and are all subject to type confusion vulnerabilities in principle. The specific affected vendor or vendors and version ranges will be disclosed when patches are available. The pattern of Mythos's ExploitBench performance (21/41 V8 ACEs in benchmark conditions) suggests V8 was a research focus, but the Glasswing disclosure details are separate from the benchmark results.

While waiting for patches, enterprise security teams have several meaningful options. First, JIT-less mode: Chrome and Chromium-based browsers support disabling the JIT compiler entirely via managed policy. This eliminates the JIT attack surface at the cost of JavaScript performance. For privileged access workstations, executive endpoints, or systems that browse only internal applications, this is a strong option. Second, site isolation: ensure strict site isolation is enabled. While this does not prevent JIT exploitation, it limits the blast radius of a renderer compromise by confining each site to its own process. Third, network segmentation: endpoints that do not need unrestricted internet access should have egress filtering to prevent attacker-controlled JavaScript from being served through enterprise browsers. Fourth, browser telemetry: deploy endpoint detection tools that monitor renderer process crashes or anomalous memory patterns, which may indicate exploitation attempts. Fifth, patch readiness: inventory your browser deployment and managed update policies so that when patches land, you can push them within hours rather than days.

JIT exploitation leaves specific artifacts if your monitoring is tuned for them. At the browser level, repeated deoptimization cycles followed by crashes can indicate fuzzing or exploitation probing. At the network level, delivery of obfuscated JavaScript with unusual structure (large numbers of function calls with alternating argument types, or explicit garbage collection triggers) may indicate exploit delivery. At the endpoint level, renderer process crashes followed by immediate respawn are suspicious in high-security contexts. Endpoint detection and response (EDR) tools that monitor heap spray patterns or unusual memory allocation sequences in browser renderer processes can catch early stages of exploitation. None of these signals is definitive in isolation, but a combination of deopt storm, renderer crash, and unusual network source warrants investigation.

The following are available exclusively to Mythos Brief subscribers. The embargo on specific vendor and version details will lift when patches are released. Subscribe at decryptiondigest.com/mythos-brief for immediate notification and the full technical packet.

The Glasswing JIT finding is not isolated. Mythos also achieved 21 out of 41 V8 arbitrary code execution challenges in ExploitBench, the only AI model to score above zero. Browser JavaScript engines represent one of the most complex, most rewarded, and most frequently patched attack surfaces in consumer software. Project Zero and independent researchers have been finding JIT bugs for over a decade. What changes with Mythos is the speed and autonomy: AI-driven review does not require a researcher who has spent years building intuition about a specific engine's internals. This means the discovery rate for JIT-class vulnerabilities is likely to increase, not decrease, as AI security tooling matures. Defenders should treat browser patching not as a routine maintenance task but as a continuous high-priority obligation.