← WebKit Silent-Fix Report — 2026-W34
b56d0c9b157522fba900fc8b8b009b4729fd42de [Text Extraction] Interaction `summary` strings should not bypass client-specified `replacementStrings`
severity low
class Bypass
confidence 0.55
interaction summary string redaction
Primitive: Text-extraction summary strings bypass client replacementString redaction
Triage note: Threads element labels/roles used in scroll-interaction summary descriptions into stringsToValidate so they pass the client-specified replacementString filter; previously these strings leaked to the client unredacted, an information-disclosure hardening.
Triage note: Threads element labels/roles used in scroll-interaction summary descriptions into stringsToValidate so they pass the client-specified replacementString filter; previously these strings leaked to the client unredacted, an information-disclosure hardening.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…