← WebKit Silent-Fix Report — 2026-W25
ea232f3860 Crash at WebKit: IPC::Encoder::grow after a call to browser.storage.local.get()
severity low
class IntOverflow
confidence 0.55
WebKit WebExtensions storage
Primitive: oversized IPC reply overflows Encoder::grow
Triage note: Adds a max-bytes-per-call limit preventing an oversized serialized reply from crashing the process in IPC encoding.
Triage note: Adds a max-bytes-per-call limit preventing an oversized serialized reply from crashing the process in IPC encoding.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…