← WebKit Silent-Fix Report — 2026-W23
3825a1a93bbf70dba2406c75919f5d5049a18607 [JSC] Fix undefined behavior in double-to-int conversions
severity low
class Other
confidence 0.55
JSC runtime
Primitive: Undefined behavior in double-to-int conversion for property/array indices
Triage note: Fixes UB when converting out-of-uint32-range double subscripts (e.g. 4294967296, large JSONP array indices) to integer indices in property access; incorrect double-to-int conversion in index handling is a soundness bug though no direct OOB primitive is shown in the visible diff.
Triage note: Fixes UB when converting out-of-uint32-range double subscripts (e.g. 4294967296, large JSONP array indices) to integer indices in property access; incorrect double-to-int conversion in index handling is a soundness bug though no direct OOB primitive is shown in the visible diff.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…