Chrome JSNativeContextSpecialization::BuildElementAccess Bypass

Chrome: Copy-on-write check bypass in JSNativeContextSpecialization::BuildElementAccess VULNERABILITY DETAILS Copy-on-write is one of V8's internal optimization features that allows multiple JavaScript objects to share the same element store. This feature is primarily used to optimize creation of...

WebKit AudioArray::allocate Data Race / Out-Of-Bounds Access

WebKit: Data race in AudioArray::allocate can lead to OOB access VULNERABILITY DETAILS Source/WebCore/platform/audio/AudioArray.h: void allocateChecked n ... while !isAllocationGood // Initially we try to allocate the exact size, but if it's not aligned // then we'll have to reallocate and from...

WebKit - Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive

WebKit - Universal XSS in JSObject::putInlineSlow and JSValue::putToPrimitive VULNERABILITY DETAILS bool JSObject::putInlineSlowExecState exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot ASSERT!isThisValueAlteredslot, this; VM& vm = exec-vm; auto scope = DECLARETHROWSCOPEvm;...

WebKit - Universal XSS Using Cached Pages Exploit

VULNERABILITY DETAILS void FrameLoader::detachChildren ... SubframeLoadingDisabler subframeLoadingDisablermframe.document; // 1 Vector, 16 childrenToDetach; childrenToDetach.reserveInitialCapacitymframe.tree.childCount; for Frame child = mframe.tree.lastChild; child; child =...

Chrome V8TrustedTypePolicyOptions::ToImpl Type Confusion Vulnerability

Chrome: Type confusion in V8TrustedTypePolicyOptions::ToImpl VULNERABILITY DETAILS The binding code generator doesn't add checks to ensure that the callback properties of a dictionary are indeed JS functions. For example, for the the TrustedTypePolicyOptions dictionary:...

Adobe Flash AS2 - textfield.filters Use-After-Free (1)

Adobe Flash AS2 - textfield.filters Use-After-Free 1 Source: https://code.google.com/p/google-security-research/issues/detail?id=330&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=476926 Credit is to bilou,...

Adobe Flash - Out-of-Bounds Read in UTF Conversion

Source: https://code.google.com/p/google-security-research/issues/detail?id=378&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id We've hit the same bug from two different avenues: 1 A report to the Chromium bug tracker:...