CVE-2018-4441

This PoC exploits a vulnerability in JavaScriptCore's array handling, specifically manipulating `m_numValuesInVector` to bypass hole checks, leading to out-of-bounds (OOB) reads/writes. The exploit leverages `Array.prototype.splice` to trigger the vulnerability by setting an unusually large array length and then manipulating it.

This is a working proof-of-concept exploit for CVE-2018-4441, targeting the PlayStation 4 WebKit on firmware 6.20. It achieves arbitrary read/write primitives and ROP chain execution, demonstrating userland code execution via syscalls like `sys_getpid()` and `sys_getuid()`.

This is a working proof-of-concept exploit for CVE-2018-4441, targeting the PlayStation 4 WebKit on firmware 6.20. It leverages a JavaScriptCore vulnerability to achieve arbitrary read/write primitives and code execution via ROP chains.