Type Confusion

chromium is vulnerable to Type Confusion. The vulnerability exists due to the system not verifying the type of object that is passed to it, and uses it blindly without type-checking...

CVE-2014-1488: Undefined Security Weakness

The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js...

Crash when using web workers with asm.js — Mozilla

Soeren Balko reported a crash when terminating a web worker running asm.js code after passing an object between threads. This crash is potentially exploitable...