← WebKit Silent-Fix Report — 2026-W21
d55bf0c070 [JSC] WebAssemblyGCStructure::finalizeUnconditionally should be called
severity medium
class UAF
confidence 0.55
JSC Heap / Wasm GC
Primitive: unconditional finalizer never run for WebAssemblyGCStructure
Triage note: A GC-managed structure whose unconditional finalizer never ran can leave stale/unreleased state, a lifetime hazard in the Wasm GC path.
Triage note: A GC-managed structure whose unconditional finalizer never ran can leave stale/unreleased state, a lifetime hazard in the Wasm GC path.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…