Developer Build News Today

Chrome: Internal JavaScript object access via Origin TrialsVULNERABILITY DETAILS1. `JSObject::DefineAccessor` doesn't ensure that the receiver object is in a valid state before creating an accessor property. This allows callers to extend non-extensible objects and reconfigure non-configurable properties.2. The function is reachable from `IDLMemberInstaller::InstallAttributes`:```IDLMemberInstaller::InstallAttributes ->InstallAttribute ->Object::SetAccessorProperty ->JSObject::Defin...