vendor:
N/A
by:
Anonymous
8.8
CVSS
HIGH
Type Confusion
843
CWE
Product Name: N/A
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: N/A
2020
Type Confusion in JavascriptNativeFloatArray::SetItem
The JavascriptNativeFloatArray::SetItem function does not check the double value given as the parameter. If the double value given as the parameter equals to JavascriptNativeFloatArray::MissingItem, it converts the float array to a var array. This can lead to type confusion.
Mitigation:
Ensure that the double value given as the parameter is checked.
