By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. External Reference:
Acknowledgments: Name: the Mozilla project Upstream:….
Source link
