CSSStyleSheet::forEachStyleScope (Source/WebCore/css/CSSStyleSheet.cpp) iterated the live member collection directly: for (Ref treeScope : m_adoptingTreeScopes) apply(protect(styleScopeFor(treeScope)));. Although Ref treeScope holds a strong reference to each element it visits, the loop still iterates over m_adoptingTreeScopes’s own backing storage. The callback apply(protect(styleScopeFor(treeScope))) runs arbitrary style-engine work that can re-enter stylesheet machinery and mutate m_adoptingTreeScopes — adding or removing adopting tree scopes — while the loop is mid-iteration. Mutating the collection reallocates/rehashes its backing store, invalidating the in-progress iterator, so the loop then reads from freed hash-table storage: a use-after-free.

The patch snapshots the collection before iterating: for (const auto& treeScope : copyToVectorOf<Ref<ContainerNode>>(m_adoptingTreeScopes)) apply(protect(styleScopeFor(treeScope)));. copyToVectorOf<Ref<ContainerNode>> builds a standalone Vector of Refs — both decoupling iteration from the mutable member container (no dangling iterator if the set changes) and keeping each referenced tree scope alive for the duration of the loop. Apple’s advisory labels this a use-after-free leading to arbitrary code execution; the one-line diff is consistent with that class: the fix is the canonical “iterate a copy, not the live container” remedy for iterator-invalidation UAF.

This is a renderer-process (WebCore style engine) bug reachable from unprivileged JavaScript that manipulates adopted stylesheets. The primitive is a use-after-free of the adopting-tree-scopes collection’s backing store, driven by reentrant mutation during iteration. Apple’s advisory states arbitrary code execution; the diff substantiates a UAF consistent with that, though the precise reentrancy path that mutates the collection mid-iteration is not shown by the one-line diff (inferred). No special privilege is required beyond running script on a malicious page.