← WebKit Silent-Fix Report — 2026-W23
cc35e71c66143f1777eb577bd3b81917356bd514 CookieStore: use the registration host/jar when removing the cookie change listener
severity low
class UAF
confidence 0.55
WebCore CookieStore
Primitive: CookieStore change listener removed with stale host leaving dangling registration
Triage note: stop()/eventListenersDidChange() recomputed host from the current document URL at removal time, so after navigation the listener registered under the original host was never removed (stale *this registration). Fix caches m_host/m_cookieJar at add time and uses them to remove, preventing a dangling change-listener.
Triage note: stop()/eventListenersDidChange() recomputed host from the current document URL at removal time, so after navigation the listener registered under the original host was never removed (stale *this registration). Fix caches m_host/m_cookieJar at add time and uses them to remove, preventing a dangling change-listener.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…