WebKit - 'WebCore::jsElementScrollHeightGetter' Use-After-Free

input:enabled content: urlfoo; padding-top: 0vmin .class4 -webkit-transform: scale1, 255; function jsfuzzer document.head.appendChildkg; var test = input.scrollHeight; ::ptr const /Users/projectzero/webkit/WebKit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x8664+0xe0a06 1 0x3000e09d8...

WebKit WebCore::jsElementScrollHeightGette Use-After-Free

WebKit: use-after-free in WebCore::jsElementScrollHeightGetter CVE-2018-4200 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of Revision 227958 on OSX. PoC Note: It might take multiple refreshes for the issue to be triggered:...