Avast discovered that the massively popular Dota 2 video game was using a V8 JavaScript engine from 2018. During their research they also found four custom game modes by a single author that exploited CVE-2021-38003 in V8. Google had fixed that bug in Chrome 95.0.4638.69 in October 2021 and already noted back then that an exploit existed in the wild. At first they discovered a test mode, which contained a lot of debug statements and was presumably used to develop a working exploit. Valve upgraded V8 on January 12, 2023, and reported that fewer than 200 players were affected, which is a small consolation for a known bug left in the game for well over a year. The blog article contains a detailed summary.
