← WebKit Silent-Fix Report — 2026-W23
afa9356bdfb252a174b3a0d53184c2ec62a1bcba REGRESSION(314285@main): [GStreamer] imported/w3c/web-platform-tests/webrtc/RTCPeerConnection-addTransceiver-renegotiation.https.html crashes
severity low
class Other
confidence 0.55
WebCore WebRTC/GStreamer
Primitive: Null codec-preferences caps null-deref in GStreamerMediaEndpoint::trackWasReplaced
Triage note: g_object_get(codec-preferences) may yield null caps; the code then called gst_caps_make_writable(caps.leakRef()) causing a null-pointer crash. Fix adds `if (!caps) return false;`. Web-reachable via RTCPeerConnection track replacement (regression), crash-only DoS.
Triage note: g_object_get(codec-preferences) may yield null caps; the code then called gst_caps_make_writable(caps.leakRef()) causing a null-pointer crash. Fix adds `if (!caps) return false;`. Web-reachable via RTCPeerConnection track replacement (regression), crash-only DoS.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…