CVE-2025-8880

Race Against Time: Cracking V8's ReadableStream with SharedArrayBuffers

Alon Barad
Alon Barad
Software Engineer

Jan 22, 2026·4 min read·5 visits

Executive Summary (TL;DR)

CVE-2025-8880 is a TOCTOU (Time-of-Check to Time-of-Use) race condition in Google Chrome's V8 engine. It occurs when `ReadableStream` consumers, specifically the WebAssembly streaming compiler, read data from a `SharedArrayBuffer`. Because the buffer is shared, a malicious worker thread can modify the memory *after* V8 validates it but *before* V8 compiles it. This allows attackers to bypass security checks, confuse the compiler, and potentially escape the V8 Sandbox to execute arbitrary code.

In the quest for blazing fast JavaScript execution, the V8 engine introduces a classic race condition. By feeding the WebAssembly streaming compiler a ReadableStream backed by a mutable SharedArrayBuffer, attackers can pull a 'bait-and-switch' on the engine—modifying bytecode between validation and compilation to achieve Remote Code Execution.

Fix Analysis (1)

Technical Appendix

CVSS Score
8.8/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Probability
0.10%
Top 85% most exploited

Affected Systems

Google Chrome < 139.0.7258.127Microsoft Edge (Chromium) < 139.0.7258.127Brave Browser < 1.75.175Opera < 117.0.5405.0V8 JavaScript Engine < 12.0

Affected Versions Detail

Product
Affected Versions
Fixed Version
Google Chrome
Google
< 139.0.7258.127139.0.7258.127
Microsoft Edge
Microsoft
< 139.0.2155139.0.2155
AttributeDetail
CWECWE-362 (Race Condition)
CVSS v3.18.8 (High)
Attack VectorNetwork (Drive-by Download)
EPSS Score0.00103 (Low/Early)
Exploit StatusPoC Available (Internal/Research)
ImpactRemote Code Execution (RCE)
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Vulnerability Timeline

Patch released by Google
2025-08-12
CVE Published
2025-08-13