← WebKit Silent-Fix Report — 2026-W34
112604f6a167ea78c004e392cd123edde551f2b5 [Site Isolation] Crash under WebFrame::fromCoreFrame
severity medium
class UAF
confidence 0.55
FrameTree teardown
Primitive: Frame tree teardown lifetime crash under WebFrame::fromCoreFrame
Triage note: FrameTree::~FrameTree now calls child->tree().detachFromParent() before disconnectView(), fixing access to partially-destroyed frame tree state during teardown (site-isolation lifetime/UAF crash).
Triage note: FrameTree::~FrameTree now calls child->tree().detachFromParent() before disconnectView(), fixing access to partially-destroyed frame tree state during teardown (site-isolation lifetime/UAF crash).
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…