Blog
Welcome to Tashita’s vulnerability research blog. Here our team publishes in-depth technical analysis of real-world vulnerabilities: browser exploitation, JavaScript engine internals (V8, WebKit, JavaScriptCore), fuzzing techniques, and full exploit walkthroughs from our CVE discoveries. Every post comes from the same research workflow that powers SeekZero, our browser vulnerability research framework.
CVE-2026-11645
V8 Vulnerability Exploited in the Wild
SeekZero Mutation Plans to Explore a Type Confusion
The vulnerability and its fix The CVE-2026-11645 vulnerability in Google Chrome's V8 JavaScript engine was caused by an inconsistent transition of an object's Map. In V8, the Map acts as an object's hidden class and represents how its[...]
AI Browser Vulnerability Research
Part 2
Teaching an LLM to Find Browser Bugs
A large language model can understand and analyze a browser's source code. If the model is trained on patterns from known vulnerabilities, it can even detect bugs given the right context and instructions. As we saw in the first[...]
AI Browser Vulnerability Research
Part 1
The Rise of AI-Driven Browser Vulnerability Research
Vulnerability research in JavaScript engines needs to keep evolving to remain effective in a context increasingly influenced by AI. LLMs can work alongside the researcher when they are integrated into the research infrastructure itself. They can analyze the[...]
CVE-2026-6307 (Part 3): Escaping the V8 Sandbox Through WasmFX
At this point, we are still inside the V8 heap sandbox. CVE-2026-6307 gives us addrof, fakeobj, and in-cage read/write. For native code execution, we need a way out. We'll use Chromium bug 502229895 for that step. WasmFX is still an experimental feature (--experimental-wasm-wasmfx) and[...]
CVE-2026-6307 (Part 2): Turbofan JS-to-Wasm Deopt Type Confusion
In Part 1, we went over the background details that are needed to follow along, as well as the trigger specifics of the bug. In Part 2, we'll go through the relevant code paths, analyze the patch, and develop[...]
CVE-2026-6307 (Part 1): Turbofan JS-to-Wasm Deopt Type Confusion
Summary CVE-2026-6307 is a V8 compiler bug in the metadata used to recover from optimized JS-to-Wasm calls. The upstream regression describes the bug as a missing signature comparison in FrameStateFunctionInfo::operator==. A type confusion in the deoptimizer caused by[...]