← WebKit Silent-Fix Report — 2026-W22
ed0f115abf [JSC] Do not release scope while it is used before forEachInIterationRecord
severity low
class LogicError
confidence 0.45
JSC iterator/Set prototype
Primitive: throw-scope released while still in use
Triage note: Corrects exception-scope release ordering around iterator fast paths; a soundness/robustness fix though exploit impact is unclear.
Triage note: Corrects exception-scope release ordering around iterator fast paths; a soundness/robustness fix though exploit impact is unclear.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…