← WebKit Silent-Fix Report — 2026-W34
6743d4ebb647587a2b5b6ae8df4041490b87eb54 cssCanvasClients() returns a set of raw Element pointers
severity low
class UAF
confidence 0.55
CanvasBase css canvas clients
Primitive: cssCanvasClients returns ref-counted Elements instead of raw pointers
Triage note: Changes HashSet<Element*> to HashSet<Ref<Element>> (element.releaseNonNull()), a lifetime hardening that prevents holding raw Element pointers that could dangle.
Triage note: Changes HashSet<Element*> to HashSet<Ref<Element>> (element.releaseNonNull()), a lifetime hardening that prevents holding raw Element pointers that could dangle.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…