← WebKit Silent-Fix Report — 2026-W23
d58bad697e50a0bda1ff67669bb4cf9e1f78662e [JSC] `ISO8601::parseDate` reads past the end of the buffer for short invalid strings
severity medium
class OOB
confidence 0.55
JSC Temporal ISO8601
Primitive: Out-of-bounds read in ISO8601::parseDate for short truncated strings
Triage note: ISO8601::parseDate applied month/day length guards only to the full Date format, so short invalid Temporal strings (e.g. "12", "--1", "2024-0") read past the buffer end; fix adds length bounds so they throw RangeError, a web-reachable OOB read.
Triage note: ISO8601::parseDate applied month/day length guards only to the full Date format, so short invalid Temporal strings (e.g. "12", "--1", "2024-0") read past the buffer end; fix adds length bounds so they throw RangeError, a web-reachable OOB read.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…