iterateClients() in CSSFontFace.cpp snapshots the live WeakHashSet<CSSFontFaceClient>& clients into a Vector<Ref<CSSFontFaceClient>> via copyToVectorOf and then calls callback(client) for each entry. Taking Ref<>s keeps the client objects alive for the duration, but it does not account for a client being unregistered (logically detached / torn down) by script that runs during one of the callbacks. A callback can synchronously execute author script — for example through a then accessor on FontFace during FontFace.load() — which mutates the DOM and removes a font-face client from the set (the layout test removes the <style> element mid-load). Because the loop iterates the pre-taken Vector, a client that has already been removed from the WeakHashSet and partially destroyed is still handed to callback, and operating on that removed/half-torn-down client is a use-after-free / memory corruption.

The fix adds if (clients.contains(client)) before each callback(client), so any client removed from the set during an earlier callback is skipped rather than invoked.

The restored invariant is that iterateClients only calls back clients that are still registered at the moment of the call, not merely those present when the snapshot was captured.

A re-entrancy use-after-free reachable from ordinary CSS @font-face plus the CSS Font Loading API. The higher CVSS (8.8) reflects that the attacker controls exactly when the client is removed (script in the then getter), yielding a groomable UAF that can be steered toward memory corruption rather than a mere crash, though escalation to code execution still needs heap shaping. Confined to the WebContent process. Reported by Milad Nasr and Nicholas Carlini with Claude, Anthropic.