← WebKit Silent-Fix Report — 2026-W23
f7a8a5c0476af3f6349707dad1fd026c80eaf763 [css-anchor-position-1] REGRESSION(311053@main): crash hiding a popover whose ::after pseudo-element inherits position-anchor and position-area
severity low
class Other
confidence 0.55
WebCore Style/AnchorPosition
Primitive: Null-pointer crash hiding a popover with an anchor-positioned ::after pseudo-element
Triage note: AnchorPositionEvaluator::makeAnchorPositionedForAnchorMap() dereferenced element after pseudoElementIfExists() could return null when hiding a popover; the added `if (!element) continue;` guards the null pseudo-element, fixing a web-reachable null-deref crash.
Triage note: AnchorPositionEvaluator::makeAnchorPositionedForAnchorMap() dereferenced element after pseudoElementIfExists() could return null when hiding a popover; the added `if (!element) continue;` guards the null pseudo-element, fixing a web-reachable null-deref crash.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…