CVE-2016-1960

This exploit leverages CVE-2017-5375 (and CVE-2016-1960) to bypass ASLR and DEP in Firefox 44.0.2 using an ASM.JS JIT spray technique. It manipulates Node objects and triggers a vulnerability to achieve arbitrary code execution, demonstrated by launching calc.exe.

This exploit targets a vulnerability in Mozilla Firefox < 45.0, specifically an nsHtml5TreeBuilder array indexing flaw, to achieve remote code execution (RCE) via a crafted HTML page. It includes a ROP chain and shellcode to bypass EMET 5.52 and execute arbitrary commands (e.g., calc.exe).