Chrome NewFixedArray Missing Array Size Check Vulnerability

Chrome suffers from a missing array size check in NewFixedArray. Chrome: Missing array size check in NewFixedArray VULNERABILITY DETAILS V8 caps the number of elements a fixed array can contain1. Most of the code that needs to create or resize a fast JS array i.e. one that's backed by a fixed arr...