← WebKit Silent-Fix Report — 2026-W34
e8b1d6b3bee17692f749f06aa2729107a2e3148d HTML parser should not insert nodes the DOM would reject
severity medium
class LogicError
confidence 0.55
html/parser (adoption agency)
Primitive: HTML parser inserts DOM-rejected nodes allowing tree cycle in adoption agency
Triage note: Adds a WPT test for an adoption-agency reparenting move that creates a tree cycle, noted as having 'crashed implementations'; enforcing that the parser not insert nodes the DOM rejects closes a tree-corruption/crash condition.
Triage note: Adds a WPT test for an adoption-agency reparenting move that creates a tree cycle, noted as having 'crashed implementations'; enforcing that the parser not insert nodes the DOM rejects closes a tree-corruption/crash condition.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…