project
V8 is Google's open-source JavaScript and WebAssembly engine, used in Chrome, Node.js, and other embedding runtimes.
No evidence-backed relationships are recorded.
A dev.to guide on Node.js memory leaks separates resident set size from the V8 heap and names four retention patterns that keep objects reachable long enough to be promoted into old space. Each has a code-level fix.
Reality
Proofpoint says a shared toolkit called BlueMoon chained two V8 flaws that Chromium had fixed in public but Chrome had not yet shipped, plus a Windows kernel bug that elevates only on older builds.
Reality
Proofpoint says two of the three bugs in the BlueMoon chain were fixed in public Chromium source before they reached stable Chrome. Defenders could close one link: an old Windows build.
Reality
The 100% ExploitBench score and two fresh V8 zero-days are OpenAI's own numbers, one of them still unverified, but the "critical" designation is a dated document that every agent deployer's controls will now be read against.
Reality
OpenAI says Astra can find unknown flaws and chain them into working exploits without a human guiding each step. The evidence published so far is one saturated public benchmark plus a 20-vulnerability internal set, in which the model found two zero-days of its own.
Reality
OpenAI graded Astra Critical against a threshold it wrote itself, then handed the top cyber capability to a handful of alpha testers while charging the safeguard friction to everyone else, API tasks included.
Reality
The benchmark hands an agent an input that already crashes a program and asks it to escalate to file access or code execution. Claude Mythos Preview managed 157 of 898 instances, with model safeguards disabled.
Reality
Endor Labs says a type confusion in isolated-vm's ExternalCopy turns a single ivm.Reference into host control-flow hijack. The remedy is a version bump to 7.0.1 or 6.2.0.
Reality