A fixed training window with a defined starting point and ordered route.
Free private trial in progress
V8 Vulnerability Research
A 60-day, source-first program for security researchers moving from V8 write-ups to independent investigation of current source.
Free private trial
Request a Free Private Trial
Leave your email to request a free seven-day private trial. Start with Memory and Representation, then continue through C++ Source Code Reading. No card.
Start HereFoundation 1 of 5
Your Next Action
Memory and Representation
Begin with byte ranges, pointers, ownership, lifetime, and object layout so later V8 abstractions have something concrete to rest on.
Begin the Model- 1Build the Model
- 2Map It to Source
- 3Inspect It in d8
- 4Prove It Independently
- 5Recall It Later
Who This Is For
Move From Write-Ups to Current Source
This training is for security researchers who can work at a terminal and reason about code, but cannot yet navigate V8 independently. Prior V8 architecture knowledge is not required.
You will trace JavaScript behavior into V8 source, bind runtime evidence to the build that produced it, reconstruct historical bugs before opening their fixes, and test bounded hypotheses against current code.
The route begins with representation, ownership, C++, and V8 object models. It does not drop a new learner into Maglev, WebAssembly, or a historical patch before the source underneath those components is readable.
Program Format
The Planned 60-Day Release
Enrollment is not open while the curriculum and completion time are still being tested.
Work independently, then bring blocked reasoning to scheduled group support.
Small intakes keep source-review feedback useful during the first release.
Payment is not open while the program remains in private testing.
Starting Point
You should be comfortable with programming and basic security reasoning. Familiarity with C or C++ helps, but the source-reading foundations teach the V8-specific types, ownership rules, and lifetime questions used later.
Weekly Work
Plan for at least eight focused hours each week. The private test is still measuring how much time different backgrounds need, so the final workload estimate may change before release.
Wrong Fit
This is not an introduction to programming, a collection of ready-made exploits, or a promise of a bug bounty. It is built for someone willing to read source, make predictions, run controlled experiments, and revise a hypothesis when the evidence disagrees.
A Small Sample
A First d8 Decision
The early exercises make one observation at a time. Before running these commands, predict which value can be encoded as a Smi and which value must be a reference to a heap object.
d8--allow-natives-syntax
const number = 7;
const object = {x: 7};
%IsSmi(number)
%IsSmi(object)
%DebugPrint(object)The output can show that number is a Smi and object is a JSObject with a V8 Map. Which part of the output describes representation, and what additional evidence would you need before making a claim about ownership or lifetime?
Later work removes the named commands and short code sample. You follow cross-file source paths, reproduce a historical failure without seeing its patch, decide whether unfamiliar code is unsafe, and test a current-source hypothesis with explicit falsifiers.
V8 Foundations
Five Shared Foundations Before Specialization
Every learner completes these source models before the research-tooling bridge and ordered component work.
- 01
Memory and Representation
Reason about byte ranges, pointer widths, storage regions, field offsets, ownership, and lifetime before treating bits as a value.
- 02
C++ Source Code Reading
Resolve inferred types, references, pointers, overloads, templates, constructors, and Zone lifetime while following real V8 code.
- 03
Values and Handles
Follow tagged values through runtime kind checks and handles that keep heap references valid when garbage collection moves an object.
- 04
Objects and Properties
Separate Maps, named properties, indexed elements, ArrayBuffer views, and backing stores, then identify what JavaScript re-entry can invalidate.
- 05
Heap and Garbage Collection
Track roots, object movement, write barriers, weak references, sweeping, and raw-pointer lifetime across allocation and collection.
Research Tooling
Use the Tools Before Component Work
The tooling bridge turns d8 output into evidence tied to a known build and execution condition.
- 01
Bind Evidence to One V8 Build
Record the runtime and pinned source revision before interpreting a trace, crash, or output difference.
- 02
Connect JavaScript to Ignition Bytecode
Use a filtered bytecode dump to find the operation and feedback slot produced by one JavaScript expression.
- 03
Read Optimization and Deoptimization Traces
Watch an observed input pattern become an optimized assumption, then identify the trace showing that the assumption stopped applying.
- 04
Separate a GC Event From a Root Cause
Distinguish collection activity from the semantic evidence needed to show that a live value changed incorrectly.
- 05
Build a Matched Execution Differential
Compare the same input across execution conditions while keeping a negative control that can reject a misleading result.
How It Is Taught
Each Module Ends in a Decision
Reading introduces the model. Progress requires using it against source and runtime evidence.
- 1
Build the Model
New terms are defined where they first appear, then connected through prose, source examples, and memory-layout diagrams.
- 2
Map It to Source
A guided check asks which exact lines establish a relationship and what those lines still do not prove.
- 3
Inspect It in d8
The learner predicts first, runs a focused command, reads the actual output, and chooses only the conclusion supported by that run.
- 4
Prove It Independently
A larger unfamiliar code sample removes the worked cues and requires both correct source mapping and an explanation in the learner's own words.
- 5
Recall It Later
The same model returns through different code samples and source files after a delay, with support restored when a long break makes reconstruction necessary.
Learner Support
Support Without an Answer Key
The planned release combines independent work with bounded reviews of the reasoning the learner actually recorded.
Weekly Group Office Hours
Bring a source path, observation, or hypothesis that has stopped moving. The discussion stays on the evidence instead of revealing an answer key.
Two Investigation Reviews
Receive human feedback on two recorded investigations, including the causal chain, negative controls, and the next source question.
Bounded AI Coach
Use one review at the relevant training checkpoint to test whether your explanation matches the work you recorded and repair a mistaken mental model.
Progress Evidence
Track delayed recall, source accuracy, false alarms, assistance, active time, and the stage reached in each component.
V8 Component Depth
Seven Components in Dependency Order
The first five foundations are shared. Later component work introduces Builtins and Runtime, Parser and Bytecode, Maglev, Turboshaft and TurboFan, Sandbox and External Memory, and WebAssembly models when the ordered route needs them. Builtins provide reachable entry paths, and ArrayBuffer views make byte ownership concrete before the route moves into compiler abstraction, WebAssembly, and the sandbox boundary.
- 01
Builtins and Runtime
Trace JavaScript-visible operations through Torque, CodeStubAssembler, generated builtins, conversions, exceptions, callbacks, and C++ runtime helpers.
- 02
ArrayBuffer and Views
Track backing stores, detach and resize behavior, offsets, fixed and length-tracking views, and checks that can become stale after observable code runs.
- 03
Heap and Garbage Collection
Audit rooting, movement, barriers, weak edges, sweeping, concurrent transitions, and external resources reached through raw pointers.
- 04
Maglev
Follow bytecode and feedback into speculative IR, representations, inlining, control flow, frame state, and eager or lazy deoptimization.
- 05
Turboshaft and TurboFan
Reason about operations, effects, aliasing, reductions, representation changes, scheduling, lowering, and deoptimization contracts.
- 06
WebAssembly
Connect validation to instances, memories, tables, wrappers, Wasm GC objects, compiler lowering, and the checks that must survive growth or re-entry.
- 07
V8 Sandbox Boundary
Follow encoded handles through pointer tables, tags, trusted space, code pointers, and external resources to determine whether corruption crosses a protected boundary.
From Known Bugs to New Work
Known Bugs Before Current Source
Historical cases teach a failure mechanism. Later stages remove the patch, file, bug class, and even the promise that a bug exists.
Reconstruct an N-Day Before Seeing Its Patch
Work from the vulnerable revision, record a hypothesis and causal chain, and reveal the fix only after committing the evidence.
Separate Bugs From Convincing Safe Code
Blind evaluations mix reviewed bugs with decoys so success includes correct rejection, calibrated confidence, and a defensible stop decision.
Audit Current Source
Choose a bounded surface, state a novel hypothesis, inspect the relevant call and state transitions, run focused probes, and record falsifiers.
Validate Impact
Establish release and default reachability, the failure mode, the security primitive, negative controls, and the exact boundary the behavior crosses.
Progress Evidence
Evidence of Growing Independence
Completion counts activity. These measures ask whether the learner can still make the research decision later and with less help.
Foundation Retention
Can the model still be reconstructed later?The first successful attempt is recorded separately from delayed recall across different code samples and source files.
Blind Judgment
Can the learner distinguish a bug from plausible safe code?Reserved evaluations track hits, misses, false alarms, and correct rejections without mixing practice cases into the score.
Causal Reasoning
Does the explanation identify the complete failure mechanism?The recorded chain connects entry, trusted fact, invalidation, unsafe use, missing guard, trigger, and safe contrast.
Comparable Pace
Is independence improving on like-for-like work?Active time and assistance are compared only within the same component, support level, and investigation mode.
Runic Labs Method
Built Around the Research Workflow
Runic Labs built the training around the work a V8 investigation requires: bind evidence to a revision, follow the relevant source path, reproduce behavior in d8, compare vulnerable and fixed code, minimize the result, and test whether the impact survives realistic conditions.
The course does not use completion points as proof of research ability. A learner advances by making source-grounded decisions, explaining the failure mechanism, and later reconstructing the same model without the original cues.
Read Runic Labs research to see how source tracing, reproduction, and root-cause analysis are documented outside the course.
Learning Design
Retrieval, Explanation, and Comparison
The design draws from cognitive science and educational psychology. It does not claim that the interface itself has been neuroscientifically validated.
Retrieval and Spacing
Foundation models and completed causal chains return after increasing delays. A missed link stays due until the whole chain can be reconstructed.
The evidence supports retrieval over restudy and distributed practice. The product's exact schedule still requires learner outcome data.
Self-Explanation and Feedback
The learner commits a prediction and causal explanation before seeing the known fix or receiving one bounded AI review.
Research supports self-explanation and feedback broadly. This V8 workflow is a domain-specific implementation, not a validated expert-production protocol.
Comparison and Faded Guidance
Vulnerable and fixed source are compared only after commitment. Later cases remove file, class, and existence cues one decision at a time.
Near-transfer evidence does not guarantee novel vulnerability discovery. Current-source and independently reviewed outcomes remain separate gates.
Private Trial
Free Private Trial in Progress
Invited learners are testing the first two complete foundation modules while the training flow and completion time are measured.
Free Private Trial in Progress
Invited learners receive seven days to work through Memory and Representation and C++ Source Code Reading while the training flow and completion time are measured.
Corpus Expansion
A small set of independently reviewed historical N-day cases is ready, with newer candidates moving through reproduction and curriculum review.
Public Release Gate
Blind real-versus-decoy progression remains unavailable until the reviewed pool is broad enough to measure discrimination without teaching from weak or unverified examples.
Pilot Outcome Evidence
Anonymized completion, delayed-recall, assistance, and discrimination results will be published only after enough invited learners have produced comparable data.
Questions
Before You Request a Trial
Do I Need Prior V8 Experience?
No. The course begins with memory, C++ source reading, V8 values, object layout, and garbage collection before it asks you to specialize in a component.
Is This a Browser Exploitation Course?
The program follows V8 bugs through reproduction, root cause, and security impact. Its primary outcome is independent V8 vulnerability research rather than a complete browser exploit chain.
Does Completion Guarantee a Novel Bug or Payout?
No. Novel discovery depends on the learner, the target, the available time, and the state of current V8. The program makes the required research decisions visible and tests them repeatedly, but it cannot guarantee a finding or a reward.
What Happens After I Request a Trial?
We will email you when a private-trial spot is available. The invitation explains how to start the seven-day preview and sign in.
Free private trial
Request a Free Private Trial
Leave your email to request a free seven-day private trial. Start with Memory and Representation, then continue through C++ Source Code Reading. No card.