← WebKit Silent-Fix Report — 2026-W21

b8c7728535  backListCount()/forwardListCount() don't match the sizes of the backList() and forwardList() arrays

severity low class OOB confidence 0.40 WebKit UIProcess back/forward list
Brady Eidson Tue May 19 13:35:20 2026 -0700 full: b8c772853573b3ad3fe83cdb92b49bf72cdafea7 bug report ↗ view on GitHub ↗
Primitive: count/array-size mismatch in back/forward list API
Triage note: A count returning more than the array actually holds could drive callers to index past the array; count/size mismatch fixed, though mostly an API-consistency bug.

Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.

Before / after

Loading diff…