CVE-2018-4386

This PoC exploits a JavaScript engine vulnerability in WebKit (CVE-2018-4386) where hoisting a function overwrites the iteration variable in a for-in loop, leading to type confusion. The arbitrary object passed to op_get_direct_pname can cause memory corruption or RCE.

This exploit leverages CVE-2018-4386, a type confusion vulnerability in WebKit, to achieve arbitrary read/write primitives on PS4 firmware 6.XX. It sprays structures, triggers the bug, and sets up fake objects for memory manipulation.

This is a detailed writeup explaining the exploitation of CVE-2018-4386, a type confusion vulnerability in WebKit's JavaScriptCore engine affecting PS4 firmware 6.XX. It describes the logic flaw in variable hoisting within `for-in` loops and how it leads to arbitrary read/write primitives.