365 Days Later: Finding and Exploiting Safari Bugs using Publicly Available Tools
Summary: Google Project Zero's Ivan Fratric reran the same Domato DOM fuzzer used a year earlier for 100,000,000 iterations against WebKitGTK+ 2.20.2 and reported 9 unique bugs to Apple, 6 of which affected the release version of Safari 11.1.2. All 9 were fixed by publication, most had sat in the WebKit codebase longer than 6 months, and Fratric wrote an exploit for one use-after-free in SVGAnimateElementBase::resetAnimatedType() to show such bugs can lead to browser compromise.
Key Takeaway: Fratric estimated the compute for that fuzzing run could be bought for about $1,000, an amount he placed within reach of a wide range of attackers with varying motivation - and the bugs still reached Safari users before internal security efforts caught them.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026