On macOS, scrollbar appearance animations are driven by AppKit through two Objective-C helper classes, WebScrollbarPartAnimationMac (an NSAnimation subclass) and WebScrollerImpDelegateMac (an NSScrollerImpDelegate), both of which held a raw C++ back-pointer ‘WebCore::ScrollerMac* _scroller’. These Objective-C objects have lifetimes controlled by AppKit and by pending animations: an NSScrollerImp retains its delegate, and running animations retain their animation objects, so they can outlive the C++ ScrollerMac that owns them. ScrollerMac::attach() re-creates the delegate: it did ’m_scrollerImpDelegate = adoptNS([[WebScrollerImpDelegateMac alloc] initWithScroller:this])’ and installed it on a fresh NSScrollerImp. If attach() ran while a previous delegate (and/or its part animations) was still alive and still referencing the old ScrollerMac, or if the ScrollerMac was subsequently destroyed while an AppKit-retained delegate/animation lingered, later NSScrollerImpDelegate/NSAnimation callbacks would dereference the stale raw _scroller pointer — a use-after-free. The bundled LayoutTest reaches this by churning scrollbar/scroller state during layout and focus/pointer-lock/form activity (‘scrollIntoViewIfNeeded’, ‘requestPointerLock’, form ‘submit’, and an appendMedium() style mutation), which can tear down and re-attach scrollers while animations/delegates are outstanding.

The fix has two parts. First, ScrollerMac is made ‘final’ and derives from CanMakeCheckedPtr<ScrollerMac> with WTF_MAKE_FAST_ALLOCATED and WTF_OVERRIDE_DELETE_FOR_CHECKED_PTR(ScrollerMac), and the two Objective-C classes’ raw ‘ScrollerMac* _scroller’ members become ‘CheckedPtrWebCore::ScrollerMac _scroller’ (with call sites updated to pass _scroller.get()). CheckedPtr participates in ScrollerMac’s checked-pointer accounting so that a dangling access is detected/aborted rather than silently reading freed memory, and the overridden delete enforces that no CheckedPtrs outlive the object. Second, ScrollerMac::attach() now calls ‘[m_scrollerImpDelegate invalidate]’ before replacing the delegate, so the outgoing delegate is explicitly torn down (its reference to the scroller cleared and its animations stopped/detached) instead of being left alive holding a pointer to a scroller that is being re-attached. Together these restore the invariant that no AppKit-retained delegate or animation ever dereferences a ScrollerMac after that scroller has stopped owning it. The exact body of WebScrollerImpDelegateMac’s invalidate method and the animation callbacks are not shown in the diff, so the precise clearing steps invalidate performs are inferred from the surrounding pattern.

The bug is a use-after-free of a heap-allocated ScrollerMac reachable from AppKit-retained scrollbar delegates/animations, giving a dangling-object dereference that fires from asynchronous animation/delegate callbacks — a strong UAF primitive because the reclamation window (a running or pending animation) is attacker-influenceable. It lives in the WebContent process’s rendering/scrolling code and is therefore confined to the WebContent sandbox, matching the ‘memory corruption’ description; realistic escalation is heap-grooming the freed slot to gain a controlled read/write toward code execution within that process, though the checked-pointer conversion means post-patch such accesses abort as controlled crashes rather than corrupting memory. On its own it does not cross the sandbox boundary.