Loading vulnerability…
JavaScriptCore DFG JIT Common-Subexpression-Elimination RCE
CVE-2020-9802 is a logic flaw in WebKit's JavaScriptCore DFG JIT compiler, affecting WebKitGTK and WPE WebKit before 2.28.3 as well as Apple WebKit consumers. Incorrect common-subexpression elimination modeled ArithNegate operations without their arithmetic mode: a checked negation could consequently be substituted with an unchecked negation. By exercising signed 32-bit INT_MIN overflow, an attacker can violate JIT integer-range assumptions and cause improper bounds-check elimination. Crafted JavaScript can thereby obtain out-of-bounds access on the JavaScriptCore heap, including corruption of adjacent JSArray metadata, which can be developed into addrof, fakeobj, and arbitrary memory read/write primitives.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Processing attacker-controlled web content can result in arbitrary code execution in the browser renderer context. The flaw provides heap out-of-bounds read/write capability and can corrupt JavaScript object metadata; demonstrated exploitation produced reliable arbitrary memory access despite WebKit mitigations including StructureID randomization and Gigacage. CVSS v3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
If you can’t patch tonight, do this now.
Until updates are installed, prevent affected WebKit-based applications from loading untrusted web content and restrict user access to untrusted websites. No vulnerability-specific workaround independent of updating the affected WebKit engine is identified.
Patch, then assume compromise.
Update WebKitGTK and WPE WebKit to version 2.28.3 or later stable releases. Apply vendor security updates for affected Apple platforms, including iOS 13.5 or later, iPadOS 13.5 or later, tvOS 13.4.5 or later, watchOS 6.2.5 or later, Safari 13.1.1 or later, iTunes for Windows 12.10.7 or later, and iCloud for Windows 11.2 or 7.19 or later. For Red Hat Enterprise Linux 8, apply RHSA-2020:4451 or a later applicable update; supported RHEL 7 Extended Lifecycle Support systems should apply RHSA-2025:10364. Upgrade RHEL versions marked will not fix or out of support to a supported fixed release.
1 exploit validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.