Microsoft Edge Chakra JIT - LdThis Type Confusion Exploit

Exploit for windows platform in category dos / poc / LdThis instructions' value type is assumed to be "Object". Since "this" can be other objects like an array, it has to be assumed to be "LikelyObject", otherwise, operations to "this" will not be checked properly. PoC: / function optarr arr0 =...

Microsoft Edge Chakra JIT LdThis Type Confusion

Microsoft Edge: Chakra: JIT: LdThis type confusion CVE-2018-0837 LdThis instructions' value type is assumed to be "Object". Since "this" can be other objects like an array, it has to be assumed to be "LikelyObject", otherwise, operations to "this" will not be checked properly. PoC: function optar...