← WebKit Silent-Fix Report — 2026-W22
5f39d2e310 Crash under WebPageProxy::createSandboxExtensionsIfNeeded()
severity low
class UAF
confidence 0.40
WebKit UIProcess drag/sandbox
Primitive: async drag callback runs after web process gone
Triage note: Adds a running-process check inside an async drag reply that creates sandbox extensions; primarily crash/lifetime hardening.
Triage note: Adds a running-process check inside an async drag reply that creates sandbox extensions; primarily crash/lifetime hardening.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…