4 ms·
It uses WebAssembly VM bug to get arbitrary memory address write/read capability within Chromium sandbox.
by coolspot 6y ago
It uses WebAssembly VM bug to get arbitrary memory address write/read capability within Chromium sandbox.
- heljara 6y agoThe actual bug is much before this though, WASM is just used to get a RWX page of memory, as v8 won't give JS that the other side of the JIT process.