← WebKit Silent-Fix Report — 2026-W21

958ef3d92e  Occasional crash in CollectionIndexCache::~CollectionIndexCache while running moveBefore tests.

severity medium class UAF confidence 0.50 WebCore DOM (CollectionIndexCache)
Ryosuke Niwa Mon May 18 15:03:58 2026 -0700 full: 958ef3d92e6ebcdd41023564aacef0f3d5d9a72a bug report ↗ view on GitHub ↗
Primitive: stale collection index cache during moveBefore
Triage note: Crash in a cache destructor tied to live-collection invalidation during node moves suggests a lifetime/consistency bug, though the shown diff is mostly test expectations.

Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.

Before / after

Loading diff…