← WebKit — 2026-W35
5c7edee974ae5800eb66b7dc2198e1a2003cc271 [SaferCPP] Address some failures found by the latest static analyzer in Source/WebKit
severity medium
class UAF
confidence 0.35
signal score 14.61
Source/WTF/
Primitive: raw this/networkProcess() captures in async NetworkProcess callbacks could outlive their objects
Triage note: Sweeping SaferCPP pass converting raw this captures to WeakPtr+RefPtr protectedThis guards and wrapping networkProcess()/connection() in protect()/CheckedPtr across NetworkProcess and WTF. UAF hardening with no single identified bug, matching the migration false-positive pattern, so not graded exploitable.
Triage note: Sweeping SaferCPP pass converting raw this captures to WeakPtr+RefPtr protectedThis guards and wrapping networkProcess()/connection() in protect()/CheckedPtr across NetworkProcess and WTF. UAF hardening with no single identified bug, matching the migration false-positive pattern, so not graded exploitable.
Structural signals: smartptr_member_added (+6.47), null_guard (+2.59), uaf_lifetime (+4.75), clamp_saturate (+1.8), area:Source/WTF/ (+1.0), large_churn (-2.0)
Commit message
[SaferCPP] Address some failures found by the latest static analyzer in Source/WebKit
https://bugs.webkit.org/show_bug.cgi?id=322482
Reviewed by Ryosuke Niwa and David Kilzer.
* Source/WebKit/GPUProcess/webrtc/RemoteAudioMediaStreamTrackRendererInternalUnitManager.cpp:
(WebKit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit::RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit):
* Source/WebKit/NetworkProcess/BackgroundFetchLoad.cpp:
* Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::NetworkConnectionToWebProcess):
* Source/WebKit/NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp:
(WebKit::ServiceWorkerSoftUpdateLoader::ServiceWorkerSoftUpdateLoader):
* Source/WebKit/NetworkProcess/cache/AsyncRevalidation.cpp:
(WebKit::NetworkCache::AsyncRevalidation::AsyncRevalidation):
* Source/WebKit/NetworkProcess/cache/NetworkCache.cpp:
(WebKit::NetworkCache::Cache::Cache):
* Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoadManager.cpp:
(WebKit::NetworkCache::SpeculativeLoadManager::PendingFrameLoad::PendingFrameLoad):
* Source/WebKit/NetworkProcess/storage/NetworkStorageManager.cpp:
(WebKit::NetworkStorageManager::NetworkStorageManager):
* Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSession.h:
* Source/WebKit/UIProcess/Cocoa/GroupActivities/GroupActivitiesSession.mm:
(WebKit::GroupActivitiesSession::GroupActivitiesSession):
* Source/WebKit/UIProcess/RemoteLayerTree/mac/RemoteLayerTreeEventDispatcher.mm:
(WebKit::m_wheelEventActivityHysteresis):
* Source/WebKit/UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::WebProcessProxy):
(WebKit::m_shutdownPreventingScopeCounter):
* Source/WebKit/UIProcess/mac/WebViewImpl.mm:
(WebKit::WebViewImpl::WebViewImpl):
* Source/WebKit/WebProcess/WebProcess.cpp:
(WebKit::WebProcess::WebProcess):
Canonical link: https://commits.webkit.org/319955@main
Before / after
Loading diff…
On This Page