What do CVEs like this one mean for the likes of fly.io and cloudflare who use V8 for sandboxing 3p workloads? I guess they have some degree of KYC and some hardening outside the sandbox, but chaining this with a container escape running under a free tier account could pwn the host.
You can just ask ChatGPT these questions these days, but it was a fun read:
fly.io depends on Firecracker microVMs, so you should be concerned if you're running untrusted code, but not concerned about other people interacting with you wrt v8.
Cloudflare depends on v8 isolates, which depend on the trustworthiness of the v8 sandbox, which is a non-trivial hurdle, but not an insurmountable one for attackers with the resources to have a v8 bug in the first place.
