WebKit-UAF-ANGLE-OOB-Analysis (CVE-2025-43529, CVE-2025-1417...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/zeroxjf/WebKit-UAF-ANGLE-OOB-Analysis
• Blog Title: WebKit-UAF-ANGLE-OOB-Analysis (CVE-2025-43529, CVE-2025-14174)
• Suggested Section: 🎯 Binary Exploitation -> Chrome Exploiting (create/extend a WebKit/JSC exploitation subpage) and/or 🎯 Binary Exploitation -> iOS Exploiting (WebKit/Safari exploit chains, JSC DFG JIT UAF, butterfly reclaim primitives, arm64e PAC considerations)

🎯 Content Summary

Title/Scope
Repository notes + PoC material analyzing an iOS Safari exploit chain on iOS 26.1 combining:
- CVE-2025-43529 (JavaScriptCore / WebKit): Use-After-Free from a DFG JIT missing write barrier (store-barrier insertion bug).
- CVE-2025-14174 (ANGLE / Metal backend): Out-of-Bounds write in WebGL2 PBO upload due to a staging-buffer allocation bug.

Repo status / environment
- Status: Work in progress; ...

🔧 Technical Details

JSC DFG missing write barrier → GC UAF (CVE-2025-43529): If a DFG Phi node “escapes” but its Upsilon inputs are not marked escaped, the Store Barrier Insertion Phase (DFGStoreBarrierInsertionPhase.cpp) may omit a write barrier for a later object store. By forcing GC (e.g., many ArrayBuffer(0x800000) allocations) and widening timing with a long loop, an attacker can cause GC to free an object (or its backing storage) that is still reachable, producing a use-after-free.

Butterfly reclaim → boxed/unboxed type confusion primitives: After the UAF frees a structure with indexed storage (e.g., a Date butterfly created via a[0] = 1.1), spray allocations to reclaim the freed butterfly memory as array element storage. Use two array “views” where one interprets the same slots as boxed pointers and another interprets them as Float64. Implement addrof by writing boxed_arr[0] = obj and reading pointe...

🤖 Agent Actions

Updated HackTricks with a new iOS WebKit/ANGLE exploitation note and linked it from the iOS exploitation index.

Changes:

• Added webkit-dfg-store-barrier-uaf-angle-oob.md detailing the JSC DFG store-barrier UAF trigger, butterfly reclaim primitives, arm64e PAC constraints, and ANGLE PBO staging-buffer OOB write.
• Linked the new page from ios-exploiting/README.md alongside existing Safari/iMessage chain coverage.

Tests: Not run (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 940
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/zeroxjf/WebKit-UAF-ANGLE-OOB-Analysis

Content Categories: Based on the analysis, this content was categorized under "🎯 Binary Exploitation -> Chrome Exploiting (create/extend a WebKit/JSC exploitation subpage) and/or 🎯 Binary Exploitation -> iOS Exploiting (WebKit/Safari exploit chains, JSC DFG JIT UAF, butterfly reclaim primitives, arm64e PAC considerations)".

Repository Maintenance:

• MD Files Formatting: 940 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge