← WebKit Silent-Fix Report — 2026-W34
527353138b7cb1b6d6f8b5c8c9fe5bf52c63c266 SpeechSynthesis::stop() must not synchronously dispatch error events; fix crash when platform cancel() calls back synchronously
severity medium
class UAF
confidence 0.55
WebCore SpeechSynthesis
Primitive: SpeechSynthesis::stop() synchronously dispatches error events causing crash on teardown
Triage note: stop() synchronously dispatched error events during platform cancel; when an iframe's SpeechSynthesis is stopped during frame teardown while the utterance's ActiveDOMObject context is being destroyed, this fires handlers on a torn-down object. Fix avoids synchronous error dispatch.
Triage note: stop() synchronously dispatched error events during platform cancel; when an iframe's SpeechSynthesis is stopped during frame teardown while the utterance's ActiveDOMObject context is being destroyed, this fires handlers on a torn-down object. Fix avoids synchronous error dispatch.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…