# Prototype pollution to native OOB

Privileged JS builtins using array ops or prototype methods on attacker-reachable objects

_Area: Memory corruption and native code. Seen in 4 disclosed reports; latest 2026-10-05. Updated 2026-10-23._

## How it works
Privileged code (engine builtins, browser internal scripts) runs in the same JS context as untrusted page code and uses ordinary JS operations on objects whose prototype chain the attacker controls. A default-constructed array, a `.push`, a `.call`/`.apply`, or a reserved-slot write assumes the operation resolves to the builtin behavior. When the attacker installs a setter or overrides a prototype method, the privileged operation is intercepted: an internal object is leaked to attacker code, or attacker-controlled values flow into a native write that skips bounds checks. The broken assumption is that prototype methods and setters are trusted.

## Where it shows up
- JS-implemented builtins that call `std_Array_push` or assign into a default `[]` argument [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2022-8-17-but-you-told-me-you-were-safe-attacking-the-mozilla-firefox-renderer-part-1.md)
- Internal scripts invoking `Function.prototype.call`/`apply` or `EventEmitter.prototype.emit` with privileged arguments [E2](https://bugbountylibrary.com/r/h1%3A187542.md)[E3](https://bugbountylibrary.com/r/h1%3A188086.md)
- Native functions like `UnsafeSetReservedSlot` called on objects reachable from script without validation [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2022-8-17-but-you-told-me-you-were-safe-attacking-the-mozilla-firefox-renderer-part-1.md)
- Privileged objects (Module, ipcRenderer) passed as arguments through overridable paths [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2022-8-17-but-you-told-me-you-were-safe-attacking-the-mozilla-firefox-renderer-part-1.md)[E3](https://bugbountylibrary.com/r/h1%3A188086.md)
- Any privileged code sharing a realm/context with page JS

## How to review
Trace every privileged operation that touches a script-reachable object. The invariant: no privileged code may invoke a prototype-resolved method or setter on an object whose prototype chain attacker script can modify, and no internal object may be passed as an argument to such a call. Check that array operations on default arrays use non-overridable primitives, that reserved-slot writes are bounds-checked, and that IPC dispatch does not route through `call`/`apply`/`emit` reachable from the page. Confirm privileged objects never escape into attacker-visible arguments.

## Variants seen
- Prototype setter on `Array.prototype[0]` intercepting a builtin push, leaking an internal Module, then OOB write via unchecked reserved-slot set [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2022-8-17-but-you-told-me-you-were-safe-attacking-the-mozilla-firefox-renderer-part-1.md)
- Overriding `Function.prototype.call` to rewrite IPC arguments from `alert()` [E2](https://bugbountylibrary.com/r/h1%3A187542.md)
- Overriding `Function.prototype.apply` to capture leaked `ipcRenderer` and send arbitrary IPC [E3](https://bugbountylibrary.com/r/h1%3A188086.md)

## Impact and severity
Renderer RCE from a memory-corruption OOB write [E1](https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2022-8-17-but-you-told-me-you-were-safe-attacking-the-mozilla-firefox-renderer-part-1.md); UXSS, settings changes and UI spoofing from arbitrary IPC [E2](https://bugbountylibrary.com/r/h1%3A187542.md)[E3](https://bugbountylibrary.com/r/h1%3A188086.md). Severity rises when the leaked object exposes a native write primitive or a privileged IPC channel. Sharing one JS context between builtins and page code is the enabling condition.

## Why fixes fail
Partial hardening of one prototype method leaves sibling paths (`call` vs `apply` vs `emit`) exploitable, as E2 and E3 show the same root cause recurring through different methods.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2022-8-17-but-you-told-me-you-were-safe-attacking-the-mozilla-firefox-renderer-part-1.md
- E2: https://bugbountylibrary.com/r/h1%3A187542.md
- E3: https://bugbountylibrary.com/r/h1%3A188086.md