Sorting Yourself Into a Use-After-Free: a Forever-Day in the BlackBerry Bold 9780's 2010 WebKit
It is 2026 and this is a browser bug from 2010 - a comparator-reentrancy use-after-free in Array.prototype.sort, in the decade-old JavaScriptCore that still ships on a BlackBerry Bold 9780. The rest of WebKit fixed this shape years ago; this frozen fork never will. A forever-day, confirmed crashing the real browser from a webpage, reversed to the stale write-back, and driven to an attacker-controlled cross-object write - with no ASLR and no NX, and an honest account of exactly where it stops.