V8 ACE Exploit 2026: How Glasswing Achieved Arbitrary Code Execution in Chrome

V8's JIT compiler (TurboFan) converts JavaScript bytecode into optimized native machine code based on observed runtime behavior. When V8 observes that a function consistently receives objects of the same shape (the same set of properties in the same order), it generates highly optimized native code that assumes that shape will continue. If the shape changes unexpectedly, V8 must deoptimize and fall back to the interpreter. Type confusion vulnerabilities exploit this optimization system. An attacker crafts JavaScript that initially presents V8 with a consistent object type, triggering JIT optimization, then violates the type assumption in a way that causes V8 to treat one type of object as a different type. The resulting native code reads or writes memory based on the wrong type's field offsets, allowing the attacker to read or write arbitrary memory locations in the renderer process's address space. From arbitrary memory read/write in a JIT-compiled process, a skilled attacker can locate and overwrite function pointers, construct return-oriented programming (ROP) chains, and redirect execution to shellcode. The V8 ACE vulnerability in the Glasswing CVE list follows this class of exploitation technique.

Anthropic published its Exploit Evals benchmark report on May 22, 2026, introducing ExploitBench as a standardized evaluation framework for measuring autonomous exploitation capability. The V8 component of ExploitBench contains 41 challenge instances, each representing a real or realistic V8 vulnerability requiring a working exploit to solve. Claude Mythos solved 21 of them autonomously, producing code that successfully achieved arbitrary code execution in a controlled V8 environment. Every other AI model evaluated, including earlier Claude versions, GPT-class models, and open-source alternatives, scored zero. A score of zero does not mean those models are incapable of writing exploit-like code. It means they failed to produce code that actually achieved ACE in the test harness, the gap between writing code that looks like an exploit and writing code that reliably exploits a specific vulnerability in a specific runtime. The 21/41 result is significant not because it means Mythos can exploit every V8 vulnerability (it solved 51%), but because it establishes that the capability threshold for autonomous browser exploitation has been crossed by an AI system for the first time. The implication for defenders is that the resource advantage historically enjoyed by well-funded exploit developers is narrowing.

Consider a simplified attack pattern for a V8 type confusion exploit. An attacker writes a JavaScript function that creates an array and a typed array (Float64Array) and manipulates the garbage collector's behavior through carefully timed allocations. By triggering a JIT compilation of a function that operates on the array, then causing the function to receive an object of an unexpected type, the attacker can make V8's JIT-compiled code write to the wrong offset in memory. With enough control over the memory layout, they can corrupt the length field of the typed array, giving themselves an out-of-bounds read/write primitive. From there, they use standard V8 exploitation techniques (addrof/fakeobj primitives, ArrayBuffer corruption) to achieve arbitrary read/write in the process address space, locate the target function (typically a WASM-related function pointer), and overwrite it with shellcode. This sequence, which previously required months of specialized V8 internals knowledge to develop, is the kind of exploit chain that Mythos generates autonomously within the ExploitBench evaluation. The Glasswing V8 ACE CVE represents a specific instance of this class in a production Chrome codebase.

V8 ACE vulnerabilities are exploitable through any webpage that an unpatched browser visits. The attacker does not need the user to download a file, enter credentials, or interact with the page beyond loading it. Common delivery mechanisms include watering hole attacks (compromising a website that the target population frequently visits, such as an industry trade publication or vendor portal), malicious advertising (injecting exploit code through a compromised ad network that serves to legitimate publisher sites), and spear-phishing (sending a link to a crafted page that exploits V8 when loaded). The drive-by exploitation model makes V8 ACE particularly dangerous in enterprise environments where users regularly browse to external sites as part of their work. A single compromised advertising network or popular industry site can be used to deliver the exploit to thousands of employees across multiple organizations simultaneously.

Chrome's multi-process architecture and sandbox model are genuine security improvements that significantly raise the cost of exploiting browser vulnerabilities. Each tab runs in a separate renderer process with limited OS privileges, enforced by a seccomp-bpf filter (Linux) or job object restrictions (Windows). A V8 ACE exploit executing in the renderer process cannot directly access the filesystem, spawn processes, or make network connections outside the browser's controlled channels. However, the sandbox has well-documented weaknesses. Sandbox escapes are a separate vulnerability class and remain actively researched by both offensive teams and defenders. The Glasswing CVE list includes a separate browser JIT vulnerability in addition to the V8 ACE, which may represent a multi-stage chain. Additionally, even a sandboxed renderer compromise allows session cookie extraction from in-memory browser state, access to in-page credentials and form data, JavaScript-level access to any data the tab can reach (including internal corporate web applications), and injection of content into the page visible to the user. Enterprise security teams should not treat the Chrome sandbox as a complete defense against V8 ACE exploitation.

Google Chrome is unique among major enterprise software in shipping security updates on a weekly cadence through the stable channel, often with minimal advance notice about specific CVE details. Chrome Browser Cloud Management (CBCM) allows enterprise administrators to manage the Chrome fleet through the Google Admin console, enforce minimum version thresholds, and monitor update compliance across managed devices. The most important policy settings for security teams are: AutoUpdateCheckPeriodMinutes (reduce to ensure frequent update checks), RelaunchNotification (set to REQUIRED_FORCE to ensure users apply updates that require a restart), and ChromeChannel (lock to Stable, never Extended Stable, which receives less frequent security updates). For organizations using Chromium-based browsers other than Google Chrome, ensure those products have a comparable update enforcement mechanism. Browser version compliance dashboards should be reviewed daily during active Glasswing disclosure periods.

V8 ACE exploitation in Chrome produces characteristic behavioral signals at the OS level. Endpoint detection and response (EDR) platforms should be configured to alert on the following patterns: unusual child processes spawned by chrome.exe or chrome (Linux) with a renderer process parent, specifically processes that are not themselves Chrome components; network connections initiated by a Chrome renderer subprocess to non-browser infrastructure; temporary files written to %APPDATA% or /tmp by Chrome renderer processes; and memory injection events where Chrome renderer processes allocate executable memory regions outside of V8's managed heap. These signals are not specific to this Glasswing CVE, but they represent the behavioral signatures of any successful V8 ACE exploitation and should be baseline detection capability in any enterprise EDR deployment.

Anthropic's Glasswing disclosure package for the V8 ACE vulnerability includes the full technical exploit chain analysis, EDR detection rules tuned to the specific behavioral patterns observed during Mythos exploitation testing, Chrome version verification scripts for fleet-wide deployment, and a prioritized list of browser configurations that increase or decrease exploitability. These are available exclusively in the free Mythos Brief.