Executive brief
Samsung Escargot, an open-source JavaScript engine, contains a flaw in how it handles memory buffers during certain operations. An attacker could exploit this to cause a system crash or potentially access data they shouldn't be able to see. This could impact the reliability of applications using this engine and lead to minor data exposure.
Technical details
A Time-of-check time-of-use (TOCTOU) race condition exists in Samsung's Escargot JavaScript engine. The vulnerability is rooted in the engine's failure to revalidate ArrayBuffer status and bounds after user-controlled code execution (such as valueOf coercion) during Atomics operations. An attacker can exploit this by detaching or resizing a buffer during the coercion phase, leading to out-of-bounds (OOB) access when the operation resumes. This local attack vector allows for potential information disclosure or integrity violations. A fix has been identified in commit 9e8084e which introduces the revalidateAtomicAccess helper to verify buffer state before memory access.
Affected products
- Samsung Escargot bab3a5797557014ce3c2e28419a6310cfba90d0d
Timeline
- 2026-06-30: advisory: NVD publication date
- 2026-06-29: patched: Fix committed to GitHub repository