Microsoft Edge JSON.parse Information Leak
Posted by deepcore on December 3, 2016 – 6:11 am
Microsoft Edge has an information leak in JSON.parse. If this function is called with a reviver, and the reviver modifies the output object to contain a native array, the Walk function assumes that this array is a Var array, and writes pointers to it. These pointers can then be read out of the array by script.
Post a reply
You must be logged in to post a comment.