This fixes an out-of-bounds read in the CSS transform fast-path parser. parseSimpleTransformValue first checks that the input has at least 9 characters (shortestValidTransformStringLength, for ‘rotate(0)’), which guarantees pos[0]..pos[8] are safe to read. It then detects the ’translate’ family by inspecting those bytes, and in the isTranslate branch reads further into the buffer — up to pos[11] (argumentStart = 11) and beyond — without any additional length check. Inputs like ’translatez’ (10 chars) or ’translate3d’ (11 chars) satisfy the isTranslate detection but are shorter than the indices the branch accesses, so reading pos[9..11] runs past the end of the buffer — an out-of-bounds read that can crash (or leak adjacent memory).

The fix adds, inside the isTranslate branch, a check end - pos < shortestValidTranslateStringLength (12, for ’translate(0)’) that returns nullptr before the higher-index reads.

The restored invariant is that each transform sub-parser verifies enough remaining length for every index it will access. The regression test sets transform to ’translatez’ and ’translate3d’.

An out-of-bounds read in the WebContent process from a crafted CSS transform value — reachable from any styled page. The advisory rates it a process crash; OOB reads can also leak adjacent memory, though this fast-path read is a comparatively narrow primitive.