← WebKit — 2026-W36
72bedbb9be63aadf286d4949041c4170f3adf95f [macOS] UAF: Locker in ThreadedScrollingTreeScrollingNodeDelegate::createTimer binds to freed ScrollingTree::m_treeLock
severity medium
class Race
confidence 0.6
signal score 11.97
Source/WebCore/page
patch-now
Primitive: scrollingTree() dereferenced without null/lifetime guard on the scrolling thread
Triage note: RC_REMOVE_SEC_ACCEL_3-gated change takes RefPtr scrollingTree and null-checks it before use in updateSnapScrollState, the scroll-snap timer lambda, and the wheel-event-test defer paths, where scrollingTree() could be null/destroyed during teardown. Fixes a null/UAF deref reachable on the scrolling thread.
Triage note: RC_REMOVE_SEC_ACCEL_3-gated change takes RefPtr scrollingTree and null-checks it before use in updateSnapScrollState, the scroll-snap timer lambda, and the wheel-event-test defer paths, where scrollingTree() could be null/destroyed during teardown. Fixes a null/UAF deref reachable on the scrolling thread.
Structural signals: smartptr_member_added (+6.47), null_guard (+1.2), msg_strong (+3.0), surgical (+1.3)
Commit message
[macOS] UAF: Locker in ThreadedScrollingTreeScrollingNodeDelegate::createTimer binds to freed ScrollingTree::m_treeLock
rdar://182127376
Reviewed by Abrar Rahman Protyasha and Wenson Hsieh.
In `ThreadedScrollingTreeScrollingNodeDelegate::createTimer`,
hold the scrolling tree in a `RefPtr` that outlives the lock.
Bail early if the scroll tree is null.
Apply this same pattern to other methods which also need it.
* Source/WebCore/page/scrolling/ThreadedScrollingTreeScrollingNodeDelegate.cpp:
(WebCore::ThreadedScrollingTreeScrollingNodeDelegate::updateSnapScrollState):
(WebCore::ThreadedScrollingTreeScrollingNodeDelegate::createTimer):
(WebCore::ThreadedScrollingTreeScrollingNodeDelegate::deferWheelEventTestCompletionForReason const):
(WebCore::ThreadedScrollingTreeScrollingNodeDelegate::removeWheelEventTestCompletionDeferralForReason const):
Identifier: 316606.633@safari-7625-branch
Before / after
Loading diff…
On This Page