← WebKit Silent-Fix Report — 2026-W22
ed57dc0915 [libpas] pas_enumerator_create should check validity of compact heap bump
severity low
class OOB
confidence 0.55
bmalloc libpas enumerator
Primitive: unchecked compact-heap bump bound
Triage note: Replaces an assertion with real bounds checks on an attacker-influenceable bump value in the out-of-process heap enumerator, preventing OOB.
Triage note: Replaces an assertion with real bounds checks on an attacker-influenceable bump value in the out-of-process heap enumerator, preventing OOB.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…