Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

pwn4fun Spring 2014 - Safari - Part I

projectzero.google | blog | #browser-exploitation | #project-zero | #safari | #webkit | #javascriptcore | #pwn4fun

Summary

Part one of a Google Project Zero pwn4fun series, detailing how a bug in Safari's JavaScriptCore engine yielded code execution inside the renderer sandbox.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
pwn4fun Spring 2014 - Safari - Part II
Part two of a Google Project Zero pwn4fun series, detailing how a Safari compromise escalated from the renderer sandbox to full system access on OS X.
blog · projectzero.google
An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit
A step-by-step analysis of an in-the-wild iOS exploit that escapes Safari's WebContent process into the GPU process, covering the underlying bug and exploitation strategy.
blog · projectzero.google
Dude, where’s my heap?
A Google Project Zero post examining heap spraying and heap address randomization, and how browser exploits can still succeed against them.
vulnerability · theori.io
Exploiting Safari’s ANGLE Component
CVE-2022-26717: an exploitable WebKit ANGLE bug in the WebGL Transform Feedback path that hit Safari on macOS and iOS, with root-cause analysis and an exploit reaching JSCell structure-id leaks.
research · theori.io
Patch Gapping a Safari Type Confusion
A WebKit AudioWorklet type-confusion bug was fixed, yet new vulnerable iOS builds still shipped for weeks afterward; Theori details the root cause and a full exploit chain built around the patch gap.
research · portswigger.net
Escaping JavaScript sandboxes with parsing issues
Fuzzing JavaScriptCore uncovered 721,520 inconsistently parsed Unicode escapes in Safari, where typeof\u{10ffdc} splits across parser paths — a class of issues that can escape JS sandboxes.
back