← WebKit Silent-Fix Report — 2026-W22
09c07d2796 [JSC] Skip transitions with symbol names in LiteralParser
severity medium
class TypeConfusion
confidence 0.50
JSC LiteralParser
Primitive: JSON key follows structure transition for symbol property name
Triage note: Prevents JSON.parse from matching a string key against a symbol-named structure transition, a structure/identity confusion.
Triage note: Prevents JSON.parse from matching a string key against a symbol-named structure transition, a structure/identity confusion.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…