Patch Gap to Mobile Renderer RCE - Pwning Samsung Internets V8

Samsung Internet on the Galaxy S25 shipped with a V8 build from May 2025 that already had public, fixed bugs, and the proper fix did not land until months later. The speakers explain why an outdated embedded JavaScript engine is an attractive n-day target, then analyze CVE-2025-10891: an integer truncation in Ignition's exception handler table that redirects control flow to an unintended bytecode offset.

The exploit relies on bytecode smuggling. Constants loaded into the instruction stream are reinterpreted as opcodes once execution jumps into them, and repeated arithmetic that advances feedback slots lets the author place larger payloads in that stream. The chain calls a privileged runtime function to deserialize a WebAssembly module whose optimized machine code is replaced with attacker-chosen instructions, giving code execution in the renderer. The attack was developed on x86 and ported to ARM for the phone.

The second stage addresses the renderer's limits. Phones only isolate sites where the user logs in, so a patched renderer can be reused for a logged-in service such as Gmail. The authors hook the built-in construct function with a callback that calls a debug evaluation routine, which runs JavaScript without the CSP check, yielding universal XSS. A live demo redirected a victim to Gmail and read the inbox. The takeaway is to keep embedded engines current and not to assume mobile isolation contains a compromised renderer.