skip to content

algoatson.github.io ~/series/browser-exploitation

❯ segfault@algoatson.github.io

browser exploitation

3 parts~10 min rss

❯ start at part 1 ›

#1pwn addrof and fakeobj — the two primitives that own a JS engine3 min

#2pwn JIT type confusion — when the optimizer believes a lie3 min

#3pwn from OOB to arbitrary R/W (and a shell)4 min