← WebKit Silent-Fix Report — 2026-W23
544a3bff9b31c9ba947710eac79486e43d053c11 [JSC] Date and DateSpecYearMonth both require a DateYear
severity medium
class OOB
confidence 0.55
Temporal ISO8601 parser
Primitive: Out-of-bounds read in ISO8601::parseDate on short DateMonth/DateDay inputs
Triage note: Short DateMonth/DateDay-prefixed inputs (e.g. "0","01","010") dereferenced past the parsing buffer in parseDate, causing OOB reads on unhardened builds (SIGTRAP on hardened). Web-reachable via Temporal.PlainDate/PlainDateTime.from(); fix returns nullopt for non-MonthDay formats lacking a DateYear.
Triage note: Short DateMonth/DateDay-prefixed inputs (e.g. "0","01","010") dereferenced past the parsing buffer in parseDate, causing OOB reads on unhardened builds (SIGTRAP on hardened). Web-reachable via Temporal.PlainDate/PlainDateTime.from(); fix returns nullopt for non-MonthDay formats lacking a DateYear.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…