← WebKit Silent-Fix Report — 2026-W23
bb7ef44f57a19f532be31fbcaef9c02ebdc51fa5 [GStreamer] Migrate MediaPlayer to PadProbeHandle
severity medium
class UAF
confidence 0.55
WebCore GStreamer MediaPlayer
Primitive: GStreamer pad probes lack lifetime/lock protection against player teardown
Triage note: Migrates raw gst_pad_add_probe callbacks (capturing `this`) to PadProbeHandle and, under m_decoderConfigurationLock, clears m_codecProbes/m_videoFrameInputProbe/OutputProbe in tearDown; this closes a race/UAF where probe callbacks on streaming threads could touch a torn-down MediaPlayerPrivateGStreamer.
Triage note: Migrates raw gst_pad_add_probe callbacks (capturing `this`) to PadProbeHandle and, under m_decoderConfigurationLock, clears m_codecProbes/m_videoFrameInputProbe/OutputProbe in tearDown; this closes a race/UAF where probe callbacks on streaming threads could touch a torn-down MediaPlayerPrivateGStreamer.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…