CVE-2019-9810

The Unofficial Incomplete Spidermonkey Bibliography

A collection of links to published articles, blog posts, talks, and other important pieces of history of the SpiderMonkey JavaScript engine The goal is try to collect together much of what has been written about SpiderMonkey across the internet This includes research done atop SpiderMonkey, as well as techniques and advances within the engine Annotations 🏚 Obsolete: Code

Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit.

Full chain exploit for CVE-2019-11708 & CVE-2019-9810 This is a full browser compromise exploit chain (CVE-2019-11708 & CVE-2019-9810) targeting Firefox on Windows 64-bit It uses CVE-2019-9810 for getting code execution in both the content process as well as the parent process and CVE-2019-11708 to trick the parent process into browsing to an arbitrary URL

Array.prototype.slice wrong alias information.

CVE-2019-9810-PoC Arrayprototypeslice wrong alias information This bug I was found last year And it was collision with @fluoroacetate in p2o 2019 It was fixed in firefox 6601

Exploit for CVE-2019-9810 Firefox on Windows 64-bit.

CVE-2019-9810 Exploit for Firefox on Windows CVE-2019-9810 is a vulnerability that has been found and exploited at Pwn2Own 2019 by Richard Zhu and Amat Cama It affects Mozilla's JavaScript engine, Spidermonkey and was used to achieve renderer compromise The issue has been fixed in mfsa2019-09 about two months ago

Edwin's stars.

Awesome Stars A curated list of my GitHub stars! Generated by starred Contents ANTLR ASL Ada Assembly AutoHotkey Awk Ballerina Batchfile Bicep Blade Brainfuck C C# C++ CMake CSS CUE Clojure CodeQL CoffeeScript Common Lisp Coq Crystal Cuda Cython D Dart Dhall Dockerfile Elixir Emacs Lisp Erlang F# F* Fennel Forth Fortran Frege GDScript Gherkin Go Groovy HCL HTML Haml Handle

https://bugs.chromium.org/p/project-zero/issues/detail?id=1820

SpiderMonkey - CVE-2019-11707 Bug: bugschromiumorg/p/project-zero/issues/detail?id=1820 Screenshots Files exploitjs - Actual exploit, prepended by saelo's utiljs & Int64js stagerjs - Used for creating constants, prepended by saelo's utiljs & Int64js stagerpy - Used to assemble instructions using keystone Output is fed to stagerj

A list of resources about JavaScript engines

This is a list of resources I used to learn about virtual machines in general, from an architecture point of view to optimizations and garbage collection strategies I've also put together some parts into a talk format, you can see the video here (slides) Contributions are very welcome! Table of Contents generated with DocToc Virtual machines JavaScript Engines V8 J