← WebKit Silent-Fix Report — 2026-W34
32aac5dacfa53cb1d89423f91f2e49e1210a3952 [GStreamer] Fix issues with pipewire device capture
severity low
class UAF
confidence 0.55
WebCore GStreamer DesktopPortal
Primitive: Dangling D-Bus response callback lifetime in GStreamer DesktopPortal camera capture
Triage note: Replaces a blocking busy-wait with async handling and adds a destructor that unsubscribes the Response signal and invokes m_currentResponseCallback(nullptr); notifyResponse uses std::exchange on the signal id, guarding the signal callback from firing into a freed DesktopPortal. Local/permissioned capture path, low severity.
Triage note: Replaces a blocking busy-wait with async handling and adds a destructor that unsubscribes the Response signal and invokes m_currentResponseCallback(nullptr); notifyResponse uses std::exchange on the signal id, guarding the signal callback from firing into a freed DesktopPortal. Local/permissioned capture path, low severity.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…