← WebKit Silent-Fix Report — 2026-W25
96d0619b3a [Wasm] BBQ `ControlData::m_tryTableTargets` should not have inline capacity
severity low
class UAF
confidence 0.45
JSC Wasm BBQ ControlData
Primitive: dangling references into inline-capacity vector
Triage note: Removing inline capacity commonly fixes references being invalidated when the vector's inline storage moves; plausible lifetime bug but low certainty from the diff.
Triage note: Removing inline capacity commonly fixes references being invalidated when the vector's inline storage moves; plausible lifetime bug but low certainty from the diff.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…