← WebKit Silent-Fix Report — 2026-W23
1682be99490a2f051957f351a9d44782b4c579f8 WebPageProxy crash in dispatchSetObscuredContentInsets() and clearTextIndicatorWithAnimation()
severity medium
class UAF
confidence 0.55
WebKit UIProcess/WebPageProxy
Primitive: WebPageProxy dereferences stale WeakPtr<process> in async load completion handlers
Triage note: loadSimulatedRequest/loadAlternateHTML/reload completion lambdas called weakProcess->send()/startResponsivenessTimer() and weakThis->send() on raw WeakPtrs that could be null after the async assumeReadAccess callback; the fix upgrades to RefPtr with null checks, fixing a use-after-free/null-deref on a freed process object.
Triage note: loadSimulatedRequest/loadAlternateHTML/reload completion lambdas called weakProcess->send()/startResponsivenessTimer() and weakThis->send() on raw WeakPtrs that could be null after the async assumeReadAccess callback; the fix upgrades to RefPtr with null checks, fixing a use-after-free/null-deref on a freed process object.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…