Seungju Oh

This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the handling of arrays, specifically in JavaScript. An attacker can trigger a read past the end of an allocated object, potentially leveraging this in conjunction with other issues to execute arbitrary code in the context of the current process.

The issue is related to an inappropriate implementation in the HTML parser, which can allow a remote attacker to leak cross-origin data. This can be achieved via a crafted HTML page. The vulnerability is also associated with incorrectly implemented security checks for standard elements, potentially allowing a remote attacker to disclose protected information.