← WebKit Silent-Fix Report — 2026-W23
ca8c809f1e71553a22215a67fe9be1d05114e6d6 Masonry fieldset legend passes isSubgrid() despite being excluded from parent grid
severity medium
class OOB
confidence 0.55
WebCore Layout
Primitive: Out-of-bounds grid track access when masonry item span exceeds axis track count
Triage note: GridMasonryLayout::gridAreaForIndefiniteGridAxisItem used spanSizeForAutoPlacedItem() unclamped, so a large 'grid-row: span N' (e.g. via a fieldset legend wrongly passing isSubgrid) indexed past m_gridAxisTracksCount. Fix clamps the span with std::min to m_gridAxisTracksCount, preventing OOB track indexing.
Triage note: GridMasonryLayout::gridAreaForIndefiniteGridAxisItem used spanSizeForAutoPlacedItem() unclamped, so a large 'grid-row: span N' (e.g. via a fieldset legend wrongly passing isSubgrid) indexed past m_gridAxisTracksCount. Fix clamps the span with std::min to m_gridAxisTracksCount, preventing OOB track indexing.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…