← WebKit — 2026-W41
96cb7254785e278d9f9342dbd326312d5c0905bf AX: more base appearance list box crashes in the accessibility tree
not a security fix
confidence 0.15
signal score 7.67
Source/WebCore/accessibility
Classified as not security-relevant.
Triage note: Accessibility refactor for select/optgroup base-appearance exposure: recursion into groups in listboxSelectedChildren, optgroup Group role, RenderListBox-gated child addition, and a defensive !m_node->parentNode() guard in listBoxOptionParentNode. Primarily AX tree feature/correctness; the destroyed-node guard is hardening with no concrete exploitable bug shown.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Triage note: Accessibility refactor for select/optgroup base-appearance exposure: recursion into groups in listboxSelectedChildren, optgroup Group role, RenderListBox-gated child addition, and a defensive !m_node->parentNode() guard in listBoxOptionParentNode. Primarily AX tree feature/correctness; the destroyed-node guard is hardening with no concrete exploitable bug shown.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.2)
Before / after
Loading diff…
On This Page