pwn.dog

BlackBerry Bold 9780

Exploiting a dead phone. Memory-corruption bugs in the decade-old WebKit / JavaScriptCore that ships on a BlackBerry Bold 9780 (BBOS 6.0.0.294) - reversed to the addresses and bytes, confirmed on real hardware, and taken as far as an owned 2010 device will safely allow. No ASLR, no NX, no vendor left to report to.

part 1

Sorting Yourself Into a Use-After-Free: a Forever-Day in the BlackBerry Bold 9780's 2010 WebKit

It is 2026 and this is a browser bug from 2010 - a comparator-reentrancy use-after-free in Array.prototype.sort, in the decade-old JavaScriptCore that still ships on a BlackBerry Bold 9780. The rest of WebKit fixed this shape years ago; this frozen fork never will. A forever-day, confirmed crashing the real browser from a webpage, reversed to the stale write-back, and driven to an attacker-controlled cross-object write - with no ASLR and no NX, and an honest account of exactly where it stops.