4 ms·
If you're really being nasty you can potentially do this even without JS - say, by using CSS layout.
by TheLoneWolfling 12y ago
If you're really being nasty you can potentially do this even without JS - say, by using CSS layout.
- crucini 12y agoBut can one predict how CSS will look to the CPU? Or do you assume a memcpy will happen at some point, and catch it then?
- TheLoneWolfling 12y agomemcpy is one route. But, given that (almost) everyone runs browsers for which the binaries, at least, are avaliable, it's relatively straightforward to come up with something that triggers the vulnerability. And even if you don't know what browser they are using, you can make guesses. For example - if you have an image that's 102px wide and immediately to the right of an image that's 57px wide, at some point the CPU will probably add 57 and 102. Things like that.