The bug is an out-of-bounds read in AudioBufferSourceNode::renderFromBuffer in Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp, specifically in the branch taken when the effective playback rate (pitchRate) evaluates to zero (the else if (!pitchRate) path). In that branch the code computes unsigned readIndex = static_cast<unsigned>(virtualReadIndex); and then, for every channel, does std::fill_n(destinationChannels[i] + writeIndex, framesToProcess, sourceChannels[i][readIndex]); — it repeatedly copies a single source sample located at readIndex. The implicit invariant is that readIndex must remain a valid index into the source buffer channel (i.e. readIndex < bufferLength/maxFrame). Before the patch nothing constrained readIndex in this branch: virtualReadIndex is advanced/positioned from the grain start offset and the accumulated playback state, and it can point past the valid frame range (or at maxFrame, the exclusive end), so sourceChannels[i][readIndex] reads out of bounds. The trigger, shown by the added layout test, is a very large negative detune value (detune.value = -0xffffff) combined with a start offset; the detune is applied as an exponential factor to the playback rate, so a large negative detune drives computedPlaybackRate toward zero, and once the rounded pitchRate is exactly 0 this vulnerable zero-rate branch is entered.

The fix reads the frame bounds into locals — int deltaFrames = static_cast<int>(virtualDeltaFrames); and maxFrame = static_cast<unsigned>(virtualMaxFrame); — and clamps: if (readIndex >= maxFrame) readIndex -= deltaFrames;, wrapping readIndex back into the buffer’s valid grain window before the fill, and finally writes the corrected value back with virtualReadIndex = readIndex; so the render loop’s state stays consistent. This restores the invariant that readIndex indexes a valid frame of the source buffer. The precise derivation of virtualReadIndex/virtualDeltaFrames/virtualMaxFrame is not fully shown in the diff (only their use in this branch is), so the exact numeric path by which readIndex exceeded maxFrame is inferred from the surrounding code and the added clamp rather than displayed line-by-line.

The primitive is an out-of-bounds read of heap memory (a single source float per channel copied across the output), executed on the WebContent process’s audio rendering path. Consistent with the CVE description and the test’s intent, the realistic outcome is an unexpected process crash rather than a reliable info-leak or memory-corruption chain, since the value read is only used as playback samples and the index is not directly attacker-controlled to an arbitrary offset. It is confined to the sandboxed WebContent process; escalation to code execution from this OOB read alone is not demonstrated and would require additional primitives.