Record · corpus.blog/posts/01a0e34a-3ee3-7326-a4a8-2e9de9c39977

Journey to Root, Episode I: The Maglev King

blog.calif.io · published 17 July 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at blog.calif.io Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 62
Words captured: 10,546

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://substackcdn.com/image/fetch/$s_!nEjT!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fd9fe0b4c-9eae-429a-95e6-9841a99c1614_848x1264.jpeg

substackcdn.com

https://blog.calif.io/i/207420380/introduction

blog.calif.io

https://blog.calif.io/i/207420380/why-do-we-do-this

blog.calif.io

https://blog.calif.io/i/207420380/so-where-were-all-the-humans

blog.calif.io

https://blog.calif.io/i/207420380/anatomy-of-an-exploit-chain

blog.calif.io

https://blog.calif.io/i/207420380/renderer-exploit-chain-overview

blog.calif.io

https://blog.calif.io/i/207420380/act-i-a-forgotten-barrier-that-derails-maglev

blog.calif.io

https://blog.calif.io/i/207420380/core-concepts

blog.calif.io

https://blog.calif.io/i/207420380/the-bug

blog.calif.io

https://blog.calif.io/i/207420380/the-trigger

blog.calif.io

https://blog.calif.io/i/207420380/building-exploit-primitives

blog.calif.io

https://blog.calif.io/i/207420380/act-ii-escape-with-a-broken-promise

blog.calif.io

https://blog.calif.io/i/207420380/the-ancient-leak

blog.calif.io

https://blog.calif.io/i/207420380/jump-and-escape

blog.calif.io

https://blog.calif.io/i/207420380/the-full-chain-in-one-file

blog.calif.io

https://blog.calif.io/i/207420380/responsible-disclosure-timeline

blog.calif.io

https://storage.googleapis.com/chrome-for-testing-public/146.0.7680.208/win64/chrome-win64.zip

storage.googleapis.com

https://github.com/califio/publications/tree/main/MADBugs/chrome/poc/

github.com

https://github.com/califio/publications/tree/main/MADBugs/chrome/poc/README.md

github.com

https://liveoverflow.com/topic/browser-exploitation/ Read at the source ↗

liveoverflow.com

https://phrack.org/papers/attacking_javascript_engines.html

phrack.org

https://projectzero.google/2020/09/jitsploitation-one.html

projectzero.google

https://www.youtube.com/watch?v=maWnIKH3JQI

youtube.com

https://blog.calif.io/p/learning-to-jailbreak-an-iphone-with

blog.calif.io

https://substackcdn.com/image/fetch/$s_!ho2w!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fe88ea874-0f1a-4f9f-ad61-9908beb0cb83_667x375.png

substackcdn.com

https://seclab.stanford.edu/RealWorldAIsec/

seclab.stanford.edu

https://substackcdn.com/image/fetch/$s_!VoXu!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F4d7f3feb-05e2-4bf8-9471-a649695563b9_1000x522.png

substackcdn.com

https://substackcdn.com/image/fetch/$s_!PQrM!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F9c413ae5-3a0c-449e-8e13-b4c295490105_3033x2097.png

substackcdn.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/objects/string.h

github.com

https://substackcdn.com/image/fetch/$s_!H7uJ!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F9dc61d9a-cbc9-40dd-876a-9be0ed17e7dd_1284x1416.png

substackcdn.com

https://substackcdn.com/image/fetch/$s_!E-zG!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fdb1a7458-89a6-41ca-8c29-6ec1f93878e8_2286x606.png

substackcdn.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/objects/heap-object.h

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/objects/smi.h

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/objects/heap-number.h

github.com

https://v8.dev/blog/maglev

v8.dev

https://v8.dev/blog/trash-talk

v8.dev

https://v8.dev/blog/orinoco-parallel-scavenger

v8.dev

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/objects/contexts.h

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/objects/property-cell.h

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/objects/property-details.h

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/maglev/maglev-ir.h

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/maglev/maglev-graph-builder.cc

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/maglev/maglev-reducer-inl.h

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/objects/contexts.cc

github.com

https://substackcdn.com/image/fetch/$s_!6JGQ!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F35b74610-6165-4b20-b403-cb2efab6d62e_1683x1803.png

substackcdn.com

https://substackcdn.com/image/fetch/$s_!N1FK!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F30ba497d-f182-4b0d-9162-0e3da08fd676_1306x1352.png

substackcdn.com

https://phrack.org/issues/70/3

phrack.org

https://substackcdn.com/image/fetch/$s_!rVOH!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa4e87660-0ace-4dfb-b49a-3ccd7e05e54a_2376x1056.png

substackcdn.com

https://substackcdn.com/image/fetch/$s_!b4XY!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F18365d44-edf8-4078-abb7-6fd2b327371b_2358x2073.png

substackcdn.com

Introducing the WebAssembly JavaScript Promise Integration API Read at the source ↗

v8.dev

https://substackcdn.com/image/fetch/$s_!mQjv!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2Fa4e428f2-fe7d-4a26-8dcb-88d9a01a1cd4_3702x4600.png

substackcdn.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/wasm/stacks.h

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/heap/heap.cc

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/wasm/wasm-objects.h

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/wasm/wasm-external-refs.cc

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/execution/isolate.cc

github.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/execution/isolate-inl.h

github.com

https://developer.chrome.com/blog/chrome-loadtimes-deprecated

developer.chrome.com

https://substackcdn.com/image/fetch/$s_!qStr!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F4940b826-6678-4033-abc3-e42dafd10d61_1440x480.png

substackcdn.com

https://github.com/v8/v8/blob/f09a91282a26caa91d016c962d785d852cfdec36/src/roots/static-roots-intl-wasm.h

github.com

https://substackcdn.com/image/fetch/$s_!kZPb!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F5b444f1e-1ea1-4689-b202-401135b1895f_2766x2889.png

substackcdn.com

https://github.com/califio/publications/tree/main/MADBugs/chrome/poc/poc.html

github.com