← WebKit Silent-Fix Report — 2026-W25
de88d16504 Unable to re-enter website environment after short delay
severity low
class UAF
confidence 0.50
WebCore model-element
Primitive: nulling a replaced model player after callback
Triage note: Re-checks the member after an async deletion callback so a freshly created player isn't clobbered - a lifetime/re-entrancy correctness fix.
Triage note: Re-checks the member after an async deletion callback so a freshly created player isn't clobbered - a lifetime/re-entrancy correctness fix.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…