2015
12.18

There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField’s parent, leading to a use-after-free.

No Comment.

Add Your Comment

You must be logged in to post a comment.