#JavaScriptCore

#phrack "Attacking JavaScript Engines: A case study of #JavaScriptCore and #CVE-2016-4622" by @5aelo

New write-up with @GenericCoding on pois0nSword, our iOS 26.1 port of DarkSword: bypassing PAC to reach arbitrary native calls from a WebKit renderer R/W, by making dyld's own loader do the write. #WebKit #JavaScriptCore #iOS #exploitdev

One of our favorite #debugging technologies comes from @mozilla, so this week we wanted to help highlight an amazing project. Part three of our #Pwn2Own series makes use of timeless debugging to root cause an exploitable race condition in #JavaScriptCore:

اگه تا حالا از #Phrack مقاله نخوندید، یه نگاه به این مقاله بندازید و با #Phrack آشنا بشید، بد نیست: Attacking JavaScript Engines: A case study of #JavaScriptCore and #CVE_2016_4622

اپل #Apple یک پچ امنیتی برای رفع دو آسیب‌پذیری zero-day منتشر کرد که هکرها از آن برای سوءاستفاده از کامپیوترهای مک با چیپ اینتل استفاده می‌کردند. یکی از این آسیب‌پذیری‌ها مربوط به اجرای کد مخرب از طریق #JavaScriptCore و دیگری به حملات #XSS از طریق موتور #WebKit مربوط است. اپل از کاربران خواسته تا سیستم‌عامل خود را فوراً به‌روزرسانی کنند تا از این حملات جلوگیری شود. #Bitcoin

REMIND/TONITE (1900 CET ONLINE @ #Zoom), @ctietze: "Make your app extensible with #JavaScriptCore"!

🚀"Bun speeds things up by utilizing the JavaScriptCore engine, while Node.js relies on the JavaScript V8 engine. JavaScriptCore is optimized for quicker startup, making Bun a great choice for faster performance. 💨 #NodeJS #JavaScriptCore #Bun #100daysofcoding"

Our next event (2022-11-24, 1900 CET ONLINE (#Zoom), @ctietze: "Make your app extensible with #JavaScriptCore"!

The first is always special - My first task as an Igalian and WebKit contributor was to refactor register information in the JSC backend. Happy to say the bird has landed: #igalia #webkit #javascriptcore

Interesting article - Is Bun.js the Node.js killer? #v8 #JavaScriptCore #bun #nodeJS #JavaScript #webdevelopment #webdev

A very good question on #JavaScript engines: Why I chose to use @webkit’s #JavaScriptCore with #NexusJS instead of using @Google’s #V8 engine like @nodejs does.

Do you know those tasks where you think : "Sure - it will take a couple of weeks.". Month and half later: "What da' hell?" Well, for...of optimization with intrinsics just landed in JSC for 32 bit archs: #igalia #javascriptcore #webkit

What if @Nodejs used @mozilla's @SpiderMonkeyJS instead of Chrome's @v8js? 🤯🔥 🧵/1 #javascript #bun #deno #nodejs #jsruntime #tutorial #codechallenge #100daysofcode #diy #advancedjs #gitpod

One of the best videos I've ever recorded is the one I teach how to recreate Node.js from Scratch and it has reached more than 100K people around the globe🥳 I have researched a lot about the main components used in the original project such as Event Loop, V8, and C++ layers /2

If we compare @Nodejs with other competitors such as #Bun and @deno_land we can see a lot of similarities and good practices Whereas Node.js and Deno use V8 Bun uses #JavaScriptCore to execute JavaScript code Well... this raises questions. /3

#JavaScriptCore CVE-2019-8765 GetterSetter Type Confusion #0day #Zeroday #Exploit #Exploits #Security

At @igalia we not only do a lot of feature development on JSC 64bits but also on 32bits (ARMv7 and MIPSel). Here's a brief tour of the implementation of the for-of intrinsic for JSC 32bit that landed a few months ago: #webkit #javascriptcore #javascript

Attacking #javascript Engines: A case study of #JavaScriptCore and #CVE-2016-4622 ::. #CyberIntelligence #Ciberseguridad #CyberSecurity #Crypto #SLDC #Hacking #Weaponization #Infosec

One of our engineers shares lessons learned from using #JavaScriptCore—and why we migrated to #WKWebView. #TechBlog #Engineering #Lucidchart

🛠 WebKitGTK+ development release 2.21.1 is now available! 👉 We are moving to a new, GLib-based API for JavaScriptCore and deprecating most of the DOM bindings API. Developers, please test and let us know what you think! 📜 Release notes:

The new JSC API in 2.21.x should make it much more convenient to interact with the JavaScript world from your C/C++ code — or from any other languages supported through GObject-Introspection 🙌. Lack of introspection support was one of the shortcomings of the old API.

The documentation for the new GLib-based #JavaScriptCore API we are introducing in the 2.21.x development releases is now available in our website, and should be fully GObject-Introspectable: 🛠

Safari, Hold Still for NaN Minutes @sherl0ck__ @n30m1nd @XI_Research #VulnerabilityAnalysis #JavaScriptCore #ASLR #Safari

live keynote on #javascriptcore from @filpizlo at #MPLR21