JavaScriptCore UXSS chain

## description

Processing maliciously crafted web content may lead to arbitrary code execution. Apple confirmed in-the-wild exploitation on Intel Macs; the same primitive applies on iOS Safari.

## impact

UXSS + RCE inside Safari. Often paired with a kernel LPE for full device compromise.

## mitigation

Update to iOS 18.1.1 / 17.7.2.

## proof of concept

// UXSS primitive sketch
const v = new DataView(new ArrayBuffer(8));
v.setFloat64(0, 1.1);
// confused load via JIT type speculation
%OptimizeFunctionOnNextCall(leak);
leak(v);

## downloads

## references

• Apple HT215786
• NVD entry