← WebKit Silent-Fix Report — 2026-W21
b8c7728535 backListCount()/forwardListCount() don't match the sizes of the backList() and forwardList() arrays
severity low
class OOB
confidence 0.40
WebKit UIProcess back/forward list
Primitive: count/array-size mismatch in back/forward list API
Triage note: A count returning more than the array actually holds could drive callers to index past the array; count/size mismatch fixed, though mostly an API-consistency bug.
Triage note: A count returning more than the array actually holds could drive callers to index past the array; count/size mismatch fixed, though mostly an API-consistency bug.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…