Although JavaScript and HTML as languages are free from use-after-frees by design (due to the lack of low-level memory access), they can still be used to exploit UAF in the engines that interpret and run JavaScript/HTML. This is how you find UAF vulnerabilities: Provide an input that causes the application to crash or misbehave. E.g. by fuzzing or an ...


How we broke PHP, hacked Pornhub and earned $20,000 We have found two use-after-free vulnerabilities in PHP’s garbage collection algorithm. Those vulnerabilities were remotely exploitable over PHP’s unserialize function.


Your question is incorrect on many levels. First, JavaScript is memory managed language. That is, a developer never actually frees memory. Instead, the JavaScript interpreter manages all of that. So, if the JavaScript interpreter is written correctly, there can be no use-after-free vulnerabilities. As such, static analysis of JavaScript will never find a ...

Only top voted, non community-wiki answers of a minimum length are eligible