Browsing the "shadow" Tag

WebKit – User-agent Shadow root Leak in WebCore::ReplacementFragment::ReplacementFragment

October 1st, 2019 📆 | 4953 Views ⚑

<!-- VULNERABILITY DETAILS editing/ReplaceSelectionCommnd.cpp: ``` Ref ReplacementFragment::insertFragmentForTestRendering(Node* rootEditableElement) { auto holder = createDefaultParagraphElement(document()); holder->appendChild(*m_fragment); rootEditableElement->appendChild(holder); // ***2*** document().updateLayoutIgnorePendingStylesheets(); return holder;

Tagged with: