With updates to the JS standard and requirements for higher runtime efficiency, Google's JS engine V8 has implemented newer features such as built-in functions like Promise.any and the Maglev mid-tier compiler. Maglev is a compilation optimization layer in V8 that is situated between Sparkplug and Turbofan in order to accelerate the optimization and compilation of JS code. However, due to the involvement of compilation and optimization-related mechanisms in the Maglev compilation layer, deep and complex code logic can hide undetected security vulnerabilities. Our research focuses on the runtime and JIT parts of the V8 engine, and through in-depth exploration of the new Promise built-in function implementation and Maglev, we disclosed two stable and reliable RCE vulnerabilities, leading to us being awarded the top vulnerability reward for Chrome V8.In this talk, we will summarize our methodology, combine it with the two RCE vulnerabilities we discovered, introduce the mechanisms of the new attack surface, and describe the root causes of the vulnerabilities we discovered. From this, we will summarize two classic vulnerability patterns that exist in the JS engine, in order to help the open-source community better identify these issues.Finally, we will summarize the exploitation techniques of the vulnerabilities and provide stable exploitation strategies, hoping to better help Google increase its depth of defense. This talk will end with a demonstration of the RCE vulnerabilities.