← WebKit Silent-Fix Report — 2026-W23
a3f3cda54a85059955df2848f0e8ef77a850c2a8 Crash in FetchRequest::initializeWith() when LocalNetworkAccess is enabled
severity medium
class LogicError
confidence 0.55
WebCore Fetch
Primitive: Empty std::optional deref in FetchRequest::initializeWith with LocalNetworkAccess
Triage note: FetchRequest::initializeWith dereferenced *init.targetAddressSpace when LocalNetworkAccessEnabled, crashing when a Request was cloned without targetAddressSpace in init; fix uses init.targetAddressSpace.value_or(input.m_targetAddressSpace), a web-reachable null-optional deref crash.
Triage note: FetchRequest::initializeWith dereferenced *init.targetAddressSpace when LocalNetworkAccessEnabled, crashing when a Request was cloned without targetAddressSpace in init; fix uses init.targetAddressSpace.value_or(input.m_targetAddressSpace), a web-reachable null-optional deref crash.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…