Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-103708. PoCs published by Google Security Research.
AI-analyzed exploit summary This exploit leverages a race condition in WebKit's `execCommand` to execute arbitrary JavaScript in the context of a victim page. The vulnerability arises from a time-of-check to time-of-use (TOCTOU) issue where `updateStyleIfNeeded` can trigger JavaScript execution before document validation, allowing an attacker to inject malicious HTML.
Description
WebKit - Universal XSS in WebCore::command
Exploits (1)
This exploit leverages a race condition in WebKit's `execCommand` to execute arbitrary JavaScript in the context of a victim page. The vulnerability arises from a time-of-check to time-of-use (TOCTOU) issue where `updateStyleIfNeeded` can trigger JavaScript execution before document validation, allowing an attacker to inject malicious HTML.