Safari

Published on
June 19, 2026
JSC Exploitation Primitives - Part 1: From One OOB to Cage-Free Arbitrary R/W
PWN JSC JavaScriptCore WebKit Safari Browser-Exploitation
Coming from V8 and landing in JavaScriptCore. Building the addrof/fakeobj/read64/write64 ladder from a single out-of-bounds write, and the JSC-specific walls (the gigacage, butterflies, NaN-boxing) that make the last step harder than it is in V8.

JSC Exploitation Primitives - Part 1: From One OOB to Cage-Free Arbitrary R/W