Benign Download

trigger.html

Reads DOM text content

SHA-2560e5feaf0fd6d1ef52eb768cddf7a017fa4bb3b37d7d4487d26d46de0a9033bc0

MaleculeH(U)

Evidence

English function-word token "the" lines 9–12

9:32… rtyArraySlot() used MachineType::AnyTagged()
10// for ALL property slots, but properties can be stored as doubles, tagged
11// pointers, or heap objects. When the property array is extended (transition
12// adds more out-of-object properties), the compiler doe …

English function-word token "this" lines 13–15

13:13… r array to determine the actual representation. This means a
14// double-representation property is loaded/stored as a tagged pointer,
15// creating a t …

English function-word token "that" lines 17–19

17// Trigger strategy:
18//   1. Create constructor that stores mixed property representations
19//      (Smi, Double, HeapObject) in out-of-object proper …

English function-word token "with" lines 20–22

20:17… operty array extension by transitioning to maps with
21//      more out-of-object properties than the current backing store
22//   3. Trigger Turbofan/M …

Reads DOM text content lines 24–33

24:30… erpretation of the raw bits
25
26var log = document.getElementById("log");
27function print(s) {
28  log.textContent += s + "\n";
29  console.log(s);
30}
31
32print("[*] CVE-2025-13223 - Property Array Extension Type Confusion");
33print("[*] Target: Chr …