---
id: 5493
title: "Escaping JavaScript sandboxes with parsing issues"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/escaping-javascript-sandboxes-with-parsing-issues"
published_at: "2020-09-08T12:26:00Z"
tags: ["fuzzing", "web-security", "sandbox-escape", "safari", "unicode-escapes", "javascriptcore"]
phying_url: "https://phying.com/item/5493"
lang: en
---

# Escaping JavaScript sandboxes with parsing issues

## Summary

Fuzzing JavaScriptCore uncovered 721,520 inconsistently parsed Unicode escapes in Safari, where typeof\u{10ffdc} splits across parser paths — a class of issues that can escape JS sandboxes.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2020-09-08T12:26:00Z
- **Original:** https://portswigger.net/research/escaping-javascript-sandboxes-with-parsing-issues
- **Phying News:** https://phying.com/item/5493