macOS / iOS JavaScriptCore – JSValue Use-After-Free in ValueProfiles
July 30th, 2019 | 🕒
https://www.ispeech.org While fuzzing JSC, I encountered the following JS program which crashes JSC from current HEAD and release (/System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc): //
Gloss