52 results · Clear filters · Feed
-
Unscored —
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script durin…
-
Unscored —
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check…
-
Unscored —CVE-2019-9813 Public exploit
Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arb…
-
Unscored —
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks…
-
Unscored —
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnera…
-
High 7.5
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…
KEV Jun 22, 2023 -
Unscored —
A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amou…
-
Unscored —
Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption…
-
Unscored —
An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitab…
-
Unscored —
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. …
-
Unscored —
An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for othe…
-
Unscored —
A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree an…