← WebKit Silent-Fix Report — 2026-W22
69ff7c4b91 CreateModelPlayer Uses ASSERT Instead of MESSAGE_CHECK for Duplicate Identifier
severity low
class Other
confidence 0.40
WebKit ModelProcess IPC
Primitive: compromised web process sends duplicate/unknown model player id
Triage note: Converts IPC-triggerable identifier assertions into validated MESSAGE_CHECKs, IPC hardening in the model process.
Triage note: Converts IPC-triggerable identifier assertions into validated MESSAGE_CHECKs, IPC hardening in the model process.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…