CVE-2021-21156&CVE-2021-21148 Chrome Array Transfer 绕过漏洞

INFO

The fix for CVE-2021-21148 has added a check in |ValueSerializer::WriteJSArrayBuffer| to make sure non-detachable array buffers cannot be transferred. The check can be bypassed with the help of asm.js and property getters.