AI audit uncovers 1-line V8 integer overflow that survived 3.5 years, enabling Chrome RCE
moyix · x · 2026-09-06
Security firm QEDAudit disclosed CVE-2026-19174, an integer overflow in Chrome's V8 engine that enables arbitrary code execution from a single line of constant arithmetic. The bug survived 3.5+ years of fuzzing, manual audits, and LLM-driven review. The auditor notes that on returning to browser/JSE vulnerability research, AI agents were finding and exploiting bugs everywhere — and it was in this process that the long-lived one-line bug surfaced.
Related event: AI Audit Uncovers 3.5-Year-Old V8 Integer Overflow Flaw(2 posts)→
More from Safety
- Typosquatted Blender MCP Repo Hit 958 Stars in Days and Silently Ran Malware — Promptmethus · 2026-10-23
- Prompt injection scanners should be positional, not phrasal: same string, different blast radius — mrpkk · 2026-10-23
- Beff Jezos calls for a 'cyber immune system' of constantly adaptive agents — beffjezos · 2026-10-23
- Security expert: cybercriminals aren't engineer-tier, AI-native crime syndicates will take time — joshua_saxe · 2026-10-23
- AI safety researchers argue even finance-grade governance may not be enough for AI — geoffreyirving · 2026-10-23
- MalwareTech: LLM-hallucinated php2shell exploits flooding GitHub don't actually work — paul_cal · 2026-10-23