Exploitation Summary
EIP tracks 1 public exploit for CVE-2018-4438. PoCs published by Google Security Research.
AI-analyzed exploit summary This PoC exploits a type confusion vulnerability in JavaScriptCore (CVE-2018-4438) by manipulating array prototypes to bypass security checks, leading to arbitrary memory corruption. The exploit leverages Proxy objects in the prototype chain to trigger incorrect assumptions in the JIT compiler.
Description
A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.
Exploits (1)
This PoC exploits a type confusion vulnerability in JavaScriptCore (CVE-2018-4438) by manipulating array prototypes to bypass security checks, leading to arbitrary memory corruption. The exploit leverages Proxy objects in the prototype chain to trigger incorrect assumptions in the JIT compiler.
References (6)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H