This is an out-of-bounds read in the interpolating (resampling) branch of AudioBufferSourceNode::renderFromBuffer in Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp. That branch performs linear interpolation between two adjacent source frames, readIndex and readIndex2, when the playback rate is non-integral or reversed. Just above the patched lines the code already conditionally rewinds/wraps readIndex2 (if (readIndex2 >= maxFrame) readIndex2 = m_isLooping ? minFrame : readIndex;), showing the intended invariant that both interpolation indices must stay within the buffer’s frame range. The invariant was not fully enforced: under certain rate/offset combinations readIndex (and/or readIndex2) could still be at or beyond bufferLength when the interpolation loop dereferences source[readIndex] and source[readIndex2], producing an OOB read of the source channel data. The added layout test triggers it with a reverse playback (playbackRate.value = -1) grain started at a fractional offset (start(undefined, 0.5)) on an 8192-frame buffer, i.e. the resampler runs backward and the computed indices fall outside the valid window.

The fix inserts a final in-loop guard — if (readIndex >= bufferLength || readIndex2 >= bufferLength) break; — that bails out of the interpolation loop before any out-of-bounds dereference; the accompanying FIXME comment explicitly frames it as a last-ditch sanity check to be later replaced by pre-loop assertions/guards. This restores the invariant that both interpolation indices are valid before the source buffer is read. Note the diff shows only the guard being added, not the full computation of readIndex/readIndex2/maxFrame/minFrame, so the exact arithmetic that let the index escape (interaction of reverse rate, fractional start offset, and virtualReadIndex advancement) is inferred from the surrounding wrap logic and the reverse-playback trigger rather than shown line-by-line.

The primitive is an out-of-bounds read of source-buffer-adjacent heap memory on the WebContent audio rendering thread; the read values feed the interpolation output, not an attacker-controlled arbitrary-offset leak, so the realistic and CVE-stated outcome is an unexpected crash rather than a robust info-disclosure or corruption primitive. It is contained within the sandboxed WebContent process. Turning this into RCE would require chaining with other bugs; the guard’s break-on-overflow shows the fix targets crash prevention rather than a demonstrated corruption channel.