← WebKit Silent-Fix Report — 2026-W23
5b5081adba8f0891b114ba01a843fbbfdb6b7cd7 [Site Isolation] Evicting a cross-site page from the back/forward cache crashes the iframe process
severity medium
class UAF
confidence 0.55
Site Isolation BFCache
Primitive: iframe process crash when evicting cross-site page from back/forward cache
Triage note: Tracks m_suspendedFrameItemID and adds SuspendedPageProxy::iframeProcesses(), and the WebBackForwardCacheEntry destructor no longer blindly sends ClearCachedPage to iframe processes; fixes a lifetime/stale-reference crash of the cross-site iframe process during BFCache eviction under site isolation.
Triage note: Tracks m_suspendedFrameItemID and adds SuspendedPageProxy::iframeProcesses(), and the WebBackForwardCacheEntry destructor no longer blindly sends ClearCachedPage to iframe processes; fixes a lifetime/stale-reference crash of the cross-site iframe process during BFCache eviction under site isolation.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…