← WebKit Silent-Fix Report — 2026-W34
884e3169771bfde0f93c3bc3ed12c55144d5cd04 [IFC] Do not leave stale display content when partial merge fails in InlineContentBuilder
severity medium
class UAF
confidence 0.55
WebCore IFC Layout
Primitive: Stale inline display content references detached layout boxes on partial-merge failure
Triage note: handlePartialDisplayContentUpdate returned early on failure leaving existing display boxes that still hold CheckedPtr to layout boxes queued for destruction (InlineDamage::m_detachedLayoutBoxes), a dangling-pointer/UAF. Fix clears displayContent() and unites damaged rects before returning.
Triage note: handlePartialDisplayContentUpdate returned early on failure leaving existing display boxes that still hold CheckedPtr to layout boxes queued for destruction (InlineDamage::m_detachedLayoutBoxes), a dangling-pointer/UAF. Fix clears displayContent() and unites damaged rects before returning.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…