!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1099 This is a regression test from: https://crbug.com/541206 . But I think it seems not possible to turn it into an UXSS in WebKit. PoC: -- body script var s = document.body.appen
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1101 Note: It seems it doesn't crash the JSC compiled without Address Sanitizer. PoC: -- (function () { for (var i = 0; i 1000000; ++i) { const v = Array 1 ? v : 1; typeof o = 'obj
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1119 This is somewhat similar to https://crbug.com/663476 . Here's a snippet of Container::replaceAllChildren. while (RefPtrNode child = m_firstChild) { removeBetween(nullptr, chil
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1121 Here's a snippet of the method SubframeLoader::requestFrame which is invoked when the |src| of an iframe object is changed. bool SubframeLoader::requestFrame(HTMLFrameOwnerEle
?php /* # Title: Brother Devices Web Auth Bypass / Change Password Exploit # Vendor: Brother ( http://www.brother.com/ ) # Affected models: Most of Brother devices from MFC, DCP, HL ADS Series - see vulnerable models below for more info # Release dat
# Source: https://m4.rkw.io/blog/cve20177643-local-root-privesc-in-proxifier-for-mac--218.html Proxifier 2.18 (also 2.17 and possibly some earlier version) ships with a KLoader binary which it installs suid root the first time Proxifier is run. This
!-- Source :https://bugs.chromium.org/p/project-zero/issues/detail?id=1114 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: =============================================
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1105 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1097 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1090 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0
!-- Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1087 There is a negative-size memmove security vulnerability in WebKit. The vulnerability was confirmed on a nightly build of WebKit. The PoC has also been observed to crash Safari
