Safari Proxy Object Type Confusion
Posted by deepcore on December 15, 2018 – 2:46 am
This Metasploit module exploits a type confusion bug in the Javascript Proxy object in WebKit. The DFG JIT does not take into account that, through the use of a Proxy, it is possible to run arbitrary JS code during the execution of a CreateThis operation. This makes it possible to change the structure of e.g. an argument without causing a bailout, leading to a type confusion.
Post a reply
You must be logged in to post a comment.