← WebKit Silent-Fix Report — 2026-W22
1ea0492626 FontChanges::platformFontFamilyNameForCSS: Retain CTFont before passing to CTFontCopyPostScriptName
severity low
class UAF
confidence 0.45
WebCore editing Cocoa
Primitive: unretained CTFont passed to CTFontCopyPostScriptName
Triage note: SaferCPP unretained-arg lifetime fix wrapping ctFont() in protect(), a defensive memory-safety hardening.
Triage note: SaferCPP unretained-arg lifetime fix wrapping ctFont() in protect(), a defensive memory-safety hardening.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…