EXPLOIT INTELLIGENCE
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object
Exploit IDGOT-45912
Platformother
Typedos
Sourceexploit-db
Published2018-11-29
Exploit summary
WebKit JSC - BytecodeGenerator::hoistSloppyModeFunctionIfNecessary Does not Invalidate the 'ForInContext' Object (https://bugs.chromium.org/p/project-zero/issues/detail?id=1665)