Скачать или смотреть New Attack Surface in Safari: Using Just One Web Audio Vulnerability to Rule Safari

In the past, Safari vulnerability researchers often focused on the DOM or JS engine, but some system libraries used by Safari, such as audio, video, font, etc., haven't received enough attention. There are few successful cases using vulnerabilities found in these modules to break Safari. Due to the built-in heap isolation mechanism of Safari, the heap used by these system libraries is not the same as the heap where the DOM objects and JS objects are located. As a result, the out-of-bounds writing vulnerabilities in these modules make it extremely difficult to overwrite some key JS objects. These vulnerabilities are difficult to exploit alone without the coordination of an info leak....

By:
JunDong Xie

Full Abstract & Presentation Materials:
https://www.blackhat.com/asia-21/brie...