← WebKit Silent-Fix Report — 2026-W34
313a4e84e9cc3044d9d5587e807074d0d6240dc1 REGRESSION (259876@main): Check for end iterator in WebStorageNamespaceProvider::decrementUseCount()
severity medium
class OOB
confidence 0.55
WebStorageNamespaceProvider
Primitive: Missing end-iterator check in decrementUseCount
Triage note: decrementUseCount() dereferenced a HashMap iterator guarded only by ASSERT; the fix returns when find() hits end(), preventing an invalid iterator dereference (invalid-memory read) regression from 259876@main.
Triage note: decrementUseCount() dereferenced a HashMap iterator guarded only by ASSERT; the fix returns when find() hits end(), preventing an invalid iterator dereference (invalid-memory read) regression from 259876@main.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…