How This JavaScript Code Exploits your Browser (CVE-2023-38600)

Hey guys - been a while.
I'm back with a new video today where we take a look at CVE-2023-38600 - a memory corruption bug within JavaScriptCore on macOS and iOS.

The bug is caused by an integer underflow, which leads to a memmove call with a large size value. In terms of WebKit vulnerabilities, this one has a nice and simple trigger which makes it a good starting point for beginners interested in WebKit exploitation and browser exploitation.

@bellis1000

[louis]

i first watched your videos when I was curious about jailbreaking years ago. Now I'm a professional developer. Wild.
Nice to see you're back.

[MildPepperCat]

Glad to see your back! Have you considered making some more modern versions of your old security research tutorials?

[martinalcala]

Understood the first time! Great explanation

[Pwndrift]

Awesome and clear video! Makes me wonder if you can actually find a full on WebKit bug by “just” auditing each arithmetic operation and checking if it’s dealing with user input

[kevinwydler]

This is so fascinating, thank you ! :)

[Former-Jailbreaker-Guy]

Hey how to make a theme for iOS 10 snowboard or winter board?

[amanDesh-cj]

It's been 3 years since you have posted a video. btw nice video

[titan]

The YouTube algorithm and subscription management sucks. I thought you’d been missing from YT a few years until I randomly came to the channel 😅

[MrJloa]

So what's all the fuzz about? So it kills the tab and?

[Psyyyyyyyyyyyyyy]

dad finally came back from the grocery store with the finest milk 🔥

[matteofalduto]

I’m wondering who discovers those. You really need a twisted mind…