Type Confusion Vulnerability.

A memory-safety bug where code accesses an object using a type incompatible with its real allocation, often enabling arbitrary read, write, or code execution. It belongs to the Application Security category of cybersecurity.

A memory-safety bug where code accesses an object using a type incompatible with its real allocation, often enabling arbitrary read, write, or code execution.

A type confusion vulnerability arises when a program reads or writes memory through a pointer or reference whose declared type differs from the underlying object's actual type. The typical trigger is missing or incorrect downcasting, polymorphism mishandling, or speculative JIT optimizations that assume a stable shape that the attacker can change. Once the runtime treats a structure as the wrong type, methods, vtables, length fields, and inline data are misinterpreted, giving the attacker controlled read/write primitives that often escalate to code execution. JavaScript engines (V8 in Chrome, JSC in Safari) and browser renderers are frequent targets, frequently demonstrated at Pwn2Own. Defenses include strong type systems, runtime checks, sandboxing, and bounds-safe languages.

Defences for Type Confusion Vulnerability typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Bad cast, Type-mismatch bug.