CVE-2018-8298

Related Files

Microsoft Edge Chakra InitializeNumberFormat / InitializeDateTimeFormat Type Confusion

Posted Aug 17, 2018

Authored by Google Security Research, lokihardt

The InitializeNumberFormat function in Intl.js is used to initialize an Intl.NumberFormat object, and InitializeDateTimeFormat is used for an Intl.DateTimeFormat object. There are two versions of each initializer. One is for WinGlob and the other is for ICU. The problem is that the versions for ICU don't check whether the given object has been initialized. This allows to initialize the same object multiple times which can lead to type confusion.

tags | exploit

advisories | CVE-2018-8298

SHA-256 | f97ca7991e591cef05e7ed6feb1a7ced14a0b1f33f4e0b684d0bbfae83d9c790

Download | Favorite | View