← WebKit Silent-Fix Report — 2026-W25
f5722de1f7 [LBSE] Guard the SVG DOM-order cache dirtying on the transform-attribute fast path
severity medium
class TypeConfusion
confidence 0.55
WebCore LBSE SVG rendering
Primitive: invoking SVG-only method on a non-SVG layer (asserts/accesses m_svgData)
Triage note: Adds isSVGLayer() check to avoid calling a method that assumes m_svgData on a non-SVG enclosing layer, a type-confusion/bad-access guard.
Triage note: Adds isSVGLayer() check to avoid calling a method that assumes m_svgData on a non-SVG enclosing layer, a type-confusion/bad-access guard.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…