The idea is to leverage heap spraying[0] in the pages to write shell code which can then be triggered from another vulnerability in the program. This shell code

The idea is to leverage heap spraying[0] in the pages to write shell code which can then be triggered from another vulnerability in the program. This shell code could live in some string in a chunk of javascript. Thus, this technique does not need to violate the memory safety of the JITTed code. This can be partially mitigated using constant blinding[1] but it isn't perfect. [0]: https://en.wikipedia.org/wiki/Heap_spraying https://en.wikipedia.org/wiki/Heap_spraying [1]: https://www.internetsociety.org/doc/dachshund-digging-and-securing-non-blinded-constants-jit-code https://www.internetsociety.org/doc/dachshund-digging-and-se...