← WebKit Silent-Fix Report — 2026-W34
1feb6ac19b06a18bee095b204f70551cb22eff3b [Skia] Do not transfer accelerated ImageBuffer to a different thread
severity medium
class Race
confidence 0.55
SkiaSerializedImageBuffer
Primitive: Accelerated Skia ImageBuffer transferred across threads (GrContext thread-affinity)
Triage note: Previously an accelerated ImageBuffer was held and re-used on another thread; fix snapshots the native image plus params so the thread-affine GrContext is not touched off-thread, closing a cross-thread GPU-resource race.
Triage note: Previously an accelerated ImageBuffer was held and re-used on another thread; fix snapshots the native image plus params so the thread-affine GrContext is not touched off-thread, closing a cross-thread GPU-resource race.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…