CVE-2023-24833

CVE-2023-24833 describes a use-after-free in Hermes’ BigIntPrimitive addition. The issue allows an attacker to leak raw data from the Hermes VM heap, but only when untrusted JavaScript is executed by Hermes. Most React Native apps are not affected. The root cause is a use-after-free in the BigInt...

CVE-2023-24833

A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an attacker to leak raw data from Hermes VM’s heap. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most...