← WebKit Silent-Fix Report — 2026-W25
cb220370b4 RemoteAudioDestinationProxy::startRenderingThread is off by one when the frame counter wraps
severity medium
class IntOverflow
confidence 0.50
WebKit GPU media
Primitive: off-by-one frame count feeding renderAudio buffer size
Triage note: Miscomputed frame count on counter wrap could drive an incorrect audio buffer length; plausible but unclear memory-safety impact.
Triage note: Miscomputed frame count on counter wrap could drive an incorrect audio buffer length; plausible but unclear memory-safety impact.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…