JIT Compiler Hardening (JIT Restriction / V8 Sandbox)
Description
Restricts or hardens Just-In-Time compilation in language runtimes and browser engines to prevent type confusion exploitation. Encompasses three postures: (1) JIT disabling — turning off JIT compilation entirely via flags (--jitless in V8, javascript.options.ion in Firefox) which eliminates JIT-spraying and JIT-based type confusion at the cost of performance; (2) V8 Sandbox enforcement — a hardware-backed memory cage that isolates JIT-compiled code and V8 heap objects from the rest of the process address space, requiring an additional sandbox escape even after achieving type confusion; (3) JIT tiering restrictions — limiting optimization tiers to reduce the surface of speculative type assumptions that can be violated. Applicable to Chromium-based browsers, Node.js, Electron applications, and SpiderMonkey-based runtimes. Complements CME-113 (CFI/Shadow Call Stack) which prevents type-confused pointers from redirecting control flow in native code.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | JIT disabling eliminates the type speculation attack surface entirely; V8 Sandbox requires the attacker to chain a sandbox escape after the type confusion, converting a single-step exploit into a multi-step chain that must defeat both the type system and the memory cage |
| Scope (S) | C → U | V8 Sandbox confines the impact of type confusion to the sandbox boundary; the attacker cannot directly reach renderer process memory or OS resources without an additional escape primitive |
CWE Relationships
Verification
Verify JIT hardening is enabled in browser or runtime configuration. Check for jitless mode, V8 Sandbox flags, or JIT disabling in Firefox preferences.
# Expected: --jitless flag present in Chromium launch configuration
# Expected: javascript.options.ion set to false for JIT-disabled mode
# Expected: V8 sandbox flags available in the Node.js runtime
# Expected: Chrome policy flags configured for JIT restriction