Chrome Internal JavaScript Object Access Via Origin Trials
Chrome: Internal JavaScript object access via Origin TrialsVULNERABILITY DETAILS1. `JSObject::DefineAccessor` doesn't ensure that the receiver object is in a valid state before creating an accessor property. This allows callers to extend non-extensible objects and reconfigure non-configurable properties.2. The function is reachable from `IDLMemberInstaller::InstallAttributes`:```IDLMemberInstaller::InstallAttributes ->InstallAttribute ->Object::SetAccessorProperty ->JSObject::DefineAccessor```3. When an origin trial is activated through a `meta`
Source: kizzmyanthia.com
