WebKit enqueuePageshowEvent / enqueuePopstateEvent Universal XSS

WebKit: UXSS: enqueuePageshowEvent and enqueuePopstateEvent don't enqueue, but dispatch CVE-2017-2510 Here is a snippet of CachedFrameBase::restore which is invoked when cached frames are restored. void CachedFrameBase::restore ... for auto& childFrame : mchildFrames...

WebKit - enqueuePageshowEvent and enqueuePopstateEvent Universal Cross-Site Scripting Exploit

Exploit for multiple platform in category dos / poc view-frame.page; frame.tree.appendChildchildFrame-view-frame; childFrame-open; enqueuePageshowEventPageshowEventPersisted; HistoryItem historyItem = frame.loader.history.currentItem; if historyItem && historyItem-stateObject...