Using Hermes’s Quicksort to run Doom: A tale of JavaScript exploitation

Using Hermes’ s Quicksort to run Doom: A tale of JavaScript exploitation

摘要

In 2020, a security researcher flagged a peculiar bug in Hermes’s Quicksort implementation. Here’s how security teams at Meta fixed the bug.