WebKit memory corruption RCE in Apple iOS, Safari, tvOS, and OS X

This repository provides a comprehensive analysis and proof-of-concept exploit for CVE-2016-4622, a memory disclosure vulnerability in WebKit's JavaScriptCore engine. The exploit leverages a TOCTOU bug in the Array.slice() fast path, where a crafted valueOf() method can shrink the array during parameter conversion, causing out-of-bounds memory to be copied and leaked. The main exploit script (Exploit/poc-memleak.js) demonstrates this primitive, and an educational script (Exploit/slice_over_array.js) explains the mechanics of Array.slice(). The repository also includes pre-built JavaScriptCore binaries (both debug and ASAN-enabled) for macOS, allowing for direct testing and analysis. The Readme.md provides an in-depth technical breakdown, exploitation walkthrough, and references. The exploit is a proof-of-concept for information disclosure and does not provide direct code execution, but it forms the basis for further exploitation (e.g., addrof/fakeobj primitives). The attack vector is browser-based, targeting users or systems running the vulnerable JavaScriptCore engine.

This repository is a proof-of-concept (PoC) exploit for CVE-2016-4622, a vulnerability in WebKit's JavaScriptCore (JSC) engine that allows attackers to achieve arbitrary memory read and write in the browser process. The repository contains several JavaScript modules (utils.js, int64.js, pwn.js) that provide utility functions, 64-bit integer manipulation, and the main exploit logic, respectively. Two HTML files (email.html and pwn.html) serve as entry points for different exploit demonstrations: - 'email.html' demonstrates how the exploit can be used to disable the browser's same-origin policy and exfiltrate a user's Gmail inbox if the user is authenticated, by making a cross-origin XMLHttpRequest to 'https://mail.google.com/mail/u/0/#inbox'. - 'pwn.html' demonstrates how the exploit can be used to inject and execute arbitrary shellcode in JIT-compiled memory, effectively achieving code execution in the browser process. The exploit works by abusing the vulnerability to create fake JavaScript objects and manipulate their internal structures, ultimately providing a 'memory' object for arbitrary memory access. The code is version-dependent and targets specific versions of WebKit JSC. The repository is structured for research and demonstration purposes, not for weaponized exploitation.