← WebKit Silent-Fix Report — 2026-W23
28e2def3391fcf13871b39813d3c2fa8d91d9a06 AX: AXObjectCache destructor wipes a newer cache's isolated tree out of treeFrameCache during overlapping iframe document transitions
severity medium
class LogicError
confidence 0.55
WebCore Accessibility AXObjectCache
Primitive: AXObjectCache destructor evicts a newer cache's isolated tree from treeFrameCache
Triage note: During overlapping iframe navigation the old AXObjectCache destructor unconditionally removes the frame's entry from treeFrameCache, wiping the newer cache's isolated tree (a cross-thread structure), so a stale/removed isolated tree is left for the accessibility thread; lifetime/ownership correctness fix with limited, non-web-reachable-RCE impact.
Triage note: During overlapping iframe navigation the old AXObjectCache destructor unconditionally removes the frame's entry from treeFrameCache, wiping the newer cache's isolated tree (a cross-thread structure), so a stale/removed isolated tree is left for the accessibility thread; lifetime/ownership correctness fix with limited, non-web-reachable-RCE impact.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…