← WebKit Silent-Fix Report — 2026-W21
825d9df307 StabilityTracer: Crash in IPC::MessageReceiverMap::invalidate()
severity medium
class UAF
confidence 0.55
WebKit IPC
Primitive: message receiver destroyed while still registered in map
Triage note: A message receiver destroyed without removing itself leaves a dangling entry invoked on invalidate; the extension controller now deregisters in its destructor, fixing a lifetime bug.
Triage note: A message receiver destroyed without removing itself leaves a dangling entry invoked on invalidate; the extension controller now deregisters in its destructor, fixing a lifetime bug.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…