In AudioWorkletNode::Constructor, the structured-clone policy used to pass the node’s options and processor data to the rendering thread unconditionally called cloneDataPolicy.allowSharedMemoryObjects(). This meant a SharedArrayBuffer could be cloned into the AudioWorklet regardless of whether the constructing global was actually allowed to use shared memory. The violated invariant is that shared memory must only be shareable when nsIGlobalObject::IsSharedMemoryAllowed() holds for the current global — the same cross-origin-isolation gate that governs SharedArrayBuffer availability elsewhere.

The fix retrieves the current global via xpc::CurrentNativeGlobal(cx) and only enables shared-memory objects in the clone policy when IsSharedMemoryAllowed() returns true. This closes the path that let non-isolated contexts obtain shared memory, and thus a high-resolution timing side channel, through the Web Audio worklet.

An attacker on a non-cross-origin-isolated web page gains access to shared memory and therefore a high-resolution timing primitive that the isolation policy is meant to withhold. This runs in the content process in the context of the victim page’s Web Audio worklet, and the only precondition is the ability to run script and instantiate an AudioWorkletNode. The gain is an information-disclosure side channel rather than direct memory corruption, consistent with the moderate severity rating.