Chrome V8 Type Confusion - KizzMyAnthia.com
Chrome: Extending non-extensible objects leads to type confusion in V8SUMMARY`v8::internal::JSObject::SetAccessor` doesn't check if the receiver is extensible before adding a new property. A potential attacker can exploit the ability to extend non-extensible objects to achieve arbitrary code execution inside the renderer process.VULNERABILITY DETAILSIn Blink, when a user calls `window.open(url)` or inserts an `iframe` element with
Sergei Glazunov Maybeobjecthandle Load Computehandler Lookupiterator Gotoif Isthehole Maybeobjecthandle Loadhandler Accessing Mainworldscriptcontext
Source: kizzmyanthia.com