← WebKit Silent-Fix Report — 2026-W22
b88376b534 TextLayout: Avoid unchecked call arguments
severity low
class UAF
confidence 0.40
WebCore graphics text
Primitive: unprotected RenderStyle reference passed to constructTextRun
Triage note: SaferCPP unchecked-arg fix wrapping style() in protect(), defensive lifetime hardening.
Triage note: SaferCPP unchecked-arg fix wrapping style() in protect(), defensive lifetime hardening.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…