>> TAG: #0day

Microsoft Edge Chakra JIT – ImplicitCallFlags Checks Bypass

Pdfium – Out-of-Bounds Read with Shading Pattern Backed by Pattern Colorspace

Microsoft Edge Chakra JIT – ‘Array.prototype.reverse’ Array Type Confusion

Pdfium – Pattern Shading Integer Overflows

Microsoft Edge Chakra JIT – ‘NewScObjectNoCtor’ Array Type Confusion

Microsoft Edge Chakra JIT – ‘LdThis’ Type Confusion

Microsoft Edge Chakra JIT – Array Type Confusion via InitProto Instructions

Microsoft Edge Chakra JIT – Memory Corruption

Microsoft Edge Chakra JIT – ‘GlobOpt::OptTagChecks’ Must Consider IsLoopPrePass Properly (2)

Chrome V8 – ‘Runtime_RegExpReplace’ Integer Overflow