| adoption-agency-001.html |
Out-of-bounds access in the adoption agency algorithm |
921 |
- |
| adoption-agency-002.html |
Adoption Agency Algorithm UAF |
930 |
- |
| adoption-agency-bailout-001.html |
Out-of-bounds access in the adoption agency algorithm bailout |
802 |
- |
| adoption-agency-custom-furthest-block.html |
Adoption agency algorithm with custom furthest-block element |
2114 |
- |
| adoption-agency-cycle-mutation.html |
Adoption agency algorithm with circular DOM mutation |
692 |
- |
| adoption-agency-pagehide-reentrant-write.html |
Adoption agency algorithm reentrancy via iframe pagehide |
1284 |
- |
| adoption-agency-shift-001.html |
Crash in the adoption agency algorithm due to shifted lists |
840 |
- |
| adoption-agency-swap-empty-list-001.html |
SwapTo OOB access with empty list |
723 |
- |
| reconstruct-active-formatting-elements-001.html |
Use-After-Free in reconstructing the active formatting elements via custom element reallocation |
1713 |
- |