bugs.chromium.org/p/project-zero… is another JScsript issue (like 1506) where a JScsript variable (Note: a variable itself, not a backing object) is not properly tracked by a garbage collector. This type of issues is interesting for 2 reasons:
1. These bugs are very difficult to find by fuzzing because an entire block of variables needs to get freed to observe a crash. We did find it by fuzzing, but only after a pretty large amount of iterations.
2. It gives you a very powerful exploitation primitive that can be reliably exploited for arbitrary read/write by triggering the bug only once.
@halvarflake and I started working on an exploit through WPAD, but stopped in celebration of Microsoft announcing a sandbox for WPAD/PAC processing.
In case you are curious or want to experiment with it, the unfinished version can be found in bugs.chromium.org/p/project-zero…. It currently only leaks the heap address of the use-after-free allocation.
