#heap

Signed-length bug on glibc 2.39 turns into a heap primitive. Safe-linking leak, unsorted-bin libc leak, tcache poisoning through an XOR cipher, and a forged exit handler chain.

Stored XSS → localhost admin → heap underflow in a native canvas manager → libc leak → arbitrary R/W → libc ROP → flag. A full web-to-pwn chain.

---

**Flag:** `HTB{Tim1ng_z@_h0ll0w_t3ll5}`

Source first:

The bug is a use-after-free in the Forth dictionary.