4

Although JavaScript and HTML as languages are free from use-after-frees by design (due to the lack of low-level memory access), they can still be used to exploit UAF in the engines that interpret and run JavaScript/HTML. This is how you find UAF vulnerabilities: Provide an input that causes the application to crash or misbehave. E.g. by fuzzing or an ...


2

How we broke PHP, hacked Pornhub and earned $20,000 We have found two use-after-free vulnerabilities in PHP’s garbage collection algorithm. Those vulnerabilities were remotely exploitable over PHP’s unserialize function.


2

Your question is incorrect on many levels. First, JavaScript is memory managed language. That is, a developer never actually frees memory. Instead, the JavaScript interpreter manages all of that. So, if the JavaScript interpreter is written correctly, there can be no use-after-free vulnerabilities. As such, static analysis of JavaScript will never find a ...


Only top voted, non community-wiki answers of a minimum length are eligible