← WebKit Silent-Fix Report — 2026-W21
958ef3d92e Occasional crash in CollectionIndexCache::~CollectionIndexCache while running moveBefore tests.
severity medium
class UAF
confidence 0.50
WebCore DOM (CollectionIndexCache)
Primitive: stale collection index cache during moveBefore
Triage note: Crash in a cache destructor tied to live-collection invalidation during node moves suggests a lifetime/consistency bug, though the shown diff is mostly test expectations.
Triage note: Crash in a cache destructor tied to live-collection invalidation during node moves suggests a lifetime/consistency bug, though the shown diff is mostly test expectations.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…