All news with #v8 tag

Google patches V8 zero-day in Chrome; admins urged

⚠️ Google released an emergency patch for a high‑severity Type Confusion vulnerability in the V8 JavaScript engine (CVE-2025-13223), which the company says is being exploited in the wild. The flaw, rated CVSS 8.8 and discovered by Clément Lecigne of Google TAG, affects Chromium‑based browsers and can enable heap corruption and potential code execution. Administrators should prioritize updating Chrome to the patched 142.0.7444.175/.176 builds. A second V8 issue, CVE-2025-13224, is also fixed.

Cloudflare addresses Workers CPU benchmark disparities

🔍 Cloudflare investigated an independent October benchmark comparing server-side JavaScript performance between Cloudflare Workers and Vercel, which initially showed Workers up to 3.5x slower. The company found multiple causes — scheduling heuristics, outdated V8 garbage-collector tuning, and framework-level inefficiencies in OpenNext/Next.js — and implemented fixes. Most changes are live and yield parity with Vercel across nearly all tested cases, with further work planned to close the remaining Next.js gap.

Safe in the Sandbox: Security Hardening for Workers

🔒 Cloudflare describes recent security hardening applied to Cloudflare Workers, combining V8 runtime changes with CPU features to strengthen isolation of customer scripts. The post highlights use of memory protection keys (PKU) assigned per-isolate, adoption of V8's sandbox and compressed pointers to confine heap corruption, and custom memory placement to pack sandboxes efficiently. Together these mitigations improve defense-in-depth and reduce opportunities for cross-isolate data leaks.