Step 1. If you are viewing this in a browser tab,
install this site as an app (Chrome menu → Install Dock UAF Demo…),
then reopen it from the Dock so it runs inside the
app_mode_loader / app-shim helper.
Step 2. Click the button below. A popup window will
open (its NativeWidgetMacNSWindow lives in the unsandboxed
app-shim process).
Step 3. Within the next
15 seconds, right-click this app's Dock icon so the
Dock context menu (with its auto-generated window list) is showing.
Keep the menu open.
Step 4. When the countdown hits zero this page closes
the popup via JavaScript and sprays Cocoa allocations into the shim heap. The
Dock menu entry titled "CLICK ME IN DOCK MENU" is now stale.
Step 5. Click the stale "CLICK ME IN DOCK MENU"
entry in the still-open Dock context menu. AppKit calls
-[NSApplication sendAction:@selector(_selectWindow:) to:<freed
NSWindow*> …]. AppShimApplication has no override, so
objc_msgSend runs on freed memory → the app-shim helper
crashes (or, with a successful reclaim, jumps to attacker-controlled code).