← WebKit Silent-Fix Report — 2026-W22

09c07d2796  [JSC] Skip transitions with symbol names in LiteralParser

severity medium class TypeConfusion confidence 0.50 JSC LiteralParser
Kai Tamkun Tue May 26 22:24:00 2026 -0700 full: 09c07d2796ab7091c475e3c4efb6e1718d73c1d6 bug report ↗ view on GitHub ↗
Primitive: JSON key follows structure transition for symbol property name
Triage note: Prevents JSON.parse from matching a string key against a symbol-named structure transition, a structure/identity confusion.

Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.

Before / after

Loading diff…