pwn4fun Spring 2014 - Safari - Part I
Summary: Ian Beer details how he achieved code execution inside Safari's renderer sandbox at the pwn4fun contest at CanSecWest in March 2014 by exploiting an integer overflow in JavaScriptCore's JSStringJoiner class. The bug stemmed from an incomplete patch that changed m_accumulatedStringsLength to a 32-bit Checked<unsigned> while the join method's overflow checks used 64-bit size_t, allowing a crafted Array.prototype.join call to truncate finalSize when passed to joinStrings and write past an allocated buffer.
Why it matters: The exploit required writing over 4 gigabytes out of bounds to trigger the truncation, yet it still yielded code execution inside Safari's renderer sandbox on a new MacBook Air - a reminder that a patch fixing a symptom rather than the root cause can leave a working attack path open for over a year.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026