← WebKit Silent-Fix Report — 2026-W34
bc0b5db0e5d31ca7a15a2bf334188ed71004e553 SourceBufferParserWebM can emit negative MediaSample.duration
severity medium
class LogicError
confidence 0.55
SourceBufferParserWebM
Primitive: WebM parser can emit MediaSample with negative duration
Triage note: Out-of-order/backwards block timecodes in attacker-supplied WebM produced negative sample durations; fix rejects backwards intra-cluster timecodes so a negative duration (unsigned-underflow / bad buffer math downstream) is not emitted.
Triage note: Out-of-order/backwards block timecodes in attacker-supplied WebM produced negative sample durations; fix rejects backwards intra-cluster timecodes so a negative duration (unsigned-underflow / bad buffer math downstream) is not emitted.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…