← WebKit Silent-Fix Report — 2026-W34
884d0116ea09545d3bebd0d91a834ecc23ab6c31 [Site Isolation] UI process crashes in WebFrameProxy::broadcastFrameTreeSyncData when a remote web process terminates while loading cross-site iframes in private browsing
severity low
class LogicError
confidence 0.55
Site Isolation frame tree sync
Primitive: UI process crash in broadcastFrameTreeSyncData after site isolation disabled
Triage note: Guards broadcast on a live page() and siteIsolationEnabled() before calling broadcastFrameTreeSyncData, fixing a UI-process crash when a remote page outlives site isolation being disabled.
Triage note: Guards broadcast on a live page() and siteIsolationEnabled() before calling broadcastFrameTreeSyncData, fixing a UI-process crash when a remote page outlives site isolation being disabled.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…