← WebKit — 2026-W41
698650b1c485482ace4dc78049deebdccfcff2fd AX: AXIsolatedObject::setSelectedChildren() releases an isolated object on the main thread
not a security fix
confidence 0.15
signal score 6.17
Source/WebCore/accessibility
Classified as not security-relevant.
Triage note: In setSelectedChildren/setSelectedRows the performFunctionOnMainThread lambda drops the protectedThis = Ref{*this} capture and reads object->axObjectCache() from the passed main-thread object instead of protectedThis->axObjectCache(). This corrects which object's cache is used; it removes rather than adds lifetime protection and shows no concrete memory-safety bug.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: In setSelectedChildren/setSelectedRows the performFunctionOnMainThread lambda drops the protectedThis = Ref{*this} capture and reads object->axObjectCache() from the passed main-thread object instead of protectedThis->axObjectCache(). This corrects which object's cache is used; it removes rather than adds lifetime protection and shows no concrete memory-safety bug.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: smartptr_member_added (+4.87), surgical (+1.3)
Before / after
Loading diff…
On This Page