RemoteImageDecoderAVFProxy::setData (Source/WebKit/GPUProcess/media/RemoteImageDecoderAVFProxy.cpp) handed the decoder a buffer taken directly from the IPC message: imageDecoder->setData(data.isNull() ? SharedBuffer::create() : data.unsafeBuffer().releaseNonNull(), allDataReceived). data.unsafeBuffer() wraps memory that is shared with and controlled by the web content process. Once setData stores and the decoder reads from that shared buffer, the web process can concurrently mutate or invalidate the underlying memory. The decoder immediately proceeds to use the data — imageDecoder->setData(...) is followed by imageDecoder->frameCount() and further decoding — reading backing store that another process can change out from under it. This is a time-of-check/time-of-use data race across the process boundary (and, if the shared mapping is torn down, a read of invalid memory), which the advisory classifies as a race condition leading to a crash.

The patch copies the bytes into GPU-process-owned memory before use: the non-null branch becomes SharedBuffer::create(data.span()) instead of data.unsafeBuffer().releaseNonNull(). By making an independent copy, the decoder no longer reads from memory the web process can concurrently modify, eliminating the race/TOCTOU on the shared backing store. (The null branch is unchanged: SharedBuffer::create().) The advisory’s “race condition … improved state handling” matches the diff; the fix is the standard “copy untrusted shared memory before consuming it” remedy.

This is a GPU-process vulnerability driven across the IPC boundary from a web content process. The primitive is a cross-process race / TOCTOU on shared-memory-backed encoded image data: the GPU process consumes a buffer the sender can concurrently mutate or invalidate, yielding at least an unexpected GPU-process crash (DoS). Apple’s advisory labels it a race condition leading to a Safari crash, which the diff substantiates; escalation beyond a crash (e.g. to GPU-process memory corruption) is not demonstrated by the one-line change (inferred). Preconditions: the attacker must be able to drive image decoding and control the shared-memory contents from the web process — standard for a compromised or malicious renderer.