← WebKit Silent-Fix Report — 2026-W23
1c9e3e8e8bcdd1531787cbf782fbf8020f3340d6 Out-of-bounds read in WebM MIME sniffer when iter reaches length()
severity medium
class OOB
confidence 0.55
WebCore MIMESniffer
Primitive: Out-of-bounds read in WebM MIME sniffer loop
Triage note: hasSignatureForWebM indexed sequence[iter] before the iter < length bound check (`while (!sequence[iter] && iter < length)`); fix reorders to `while (iter < length && !sequence[iter])`. One-byte OOB read on attacker-controlled media bytes.
Triage note: hasSignatureForWebM indexed sequence[iter] before the iter < length bound check (`while (!sequence[iter] && iter < length)`); fix reorders to `while (iter < length && !sequence[iter])`. One-byte OOB read on attacker-controlled media bytes.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…