← WebKit Silent-Fix Report — 2026-W21
9b473b0e91 StyleOriginatedTimelinesController::documentDidResolveStyle: Use removeIf
severity medium
class UAF
confidence 0.55
WebCore animation
Primitive: hashmap mutation during iteration
Triage note: Old code removed from m_nameToTimelineMap during range-based iteration, an iterator-invalidation/UAF pattern now fixed with removeIf.
Triage note: Old code removed from m_nameToTimelineMap during range-based iteration, an iterator-invalidation/UAF pattern now fixed with removeIf.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…