Vulnerability (CVE)
Project Zero's Samuel Groß detailed CVE-2020-9802, a JavaScriptCore JIT compiler bug in which DFGClobberize failed to account for the ArithMode of ArithNegate, letting common-subexpression elimination substitute a checked negation with an unchecked one....
Project Zero's Samuel Groß detailed how a Safari JIT bug, CVE-2020-9802, was turned into a stable arbitrary memory read/write primitive by faking a JSArray object and reading a legitimate JSCell header to bypass WebKit's StructureID randomization. The...
Google Project Zero's Samuel Groß published the third part of a series on a Safari renderer exploit, detailing how iOS 13's JIT hardenings - APRR and PAC - can be bypassed; the exploited vulnerability CVE-2020-9802 was fixed in iOS 13.5, while two...