WebKit suffers from a RenderMathMLToken use-after-free vulnerability in CSSCrossfadeValue::crossfadeChanged.
2b3fca29e24705325c2e8f69792ec1fc6a23682a01cfd1f0ecc2b118ac3f4ef8
CVE-2020-0986, which was exploited in the wild, was not fixed. The vulnerability still exists, just the exploitation method had to change. A low integrity process can send LPC messages to splwow64.exe (Medium integrity) and gain a write-what-where primitive in splwow64’s memory space. The attacker controls the destination, the contents that are copied, and the number of bytes copied through a memcpy call.
2deda0d9cacd17b84943f485aeea236f1b4dc0389dcdbb9cc34a1cf168d4a259
Android Binder use-after-free exploit.
8311b9bec91595d2878834472570bf80e596b211d30a53cac581c4c7c5478c85
Android suffers from a use-after-free vulnerability in the binder driver at /drivers/android/binder.c.
8dde0209556c374a93c461cbeb04864602bbfb4b716b81b0ea7f5aa78231b126