Chrome V8 JIT suffers from a NodeProperties::InferReceiverMaps type confusion vulnerability. Continue reading...