← WebKit Silent-Fix Report — 2026-W23
dc24f31e117d804296b6b5a1fa56014a6e9fe21a Potential null deref in HIDDevice::uniqueInputElementsInDeviceTreeOrder when an HID collection has no children
severity low
class Other
confidence 0.55
WebCore HID (mac)
Primitive: Null-deref in HIDDevice::uniqueInputElementsInDeviceTreeOrder for empty HID collection
Triage note: IOHIDElementGetChildren can return null; the old loop called CFArrayGetCount(children.get()) unconditionally. Fix guards with `children ? CFArrayGetCount(...) : 0`. Requires a local HID device with an empty collection, so crash-only/low.
Triage note: IOHIDElementGetChildren can return null; the old loop called CFArrayGetCount(children.get()) unconditionally. Fix guards with `children ? CFArrayGetCount(...) : 0`. Requires a local HID device with an empty collection, so crash-only/low.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…