← WebKit — 2026-W36

d6e2e670e84753c4fd93a700868105d80be12567  SMIL animation of a presentation attribute is never released when the element is detached mid-animation

not a security fix confidence 0.15 signal score 6 Source/WebCore/svg
Classified as not security-relevant.
Triage note: removeAnimatedStyleProperty switches from protect(ensureAnimatedSMILStyleProperties())->removeProperty to a non-creating animatedSMILStyleProperties() with an early return when null, and removes the isConnected/!parentNode guard in the other overload. This is a logic/cleanup change with no identified memory-safety bug or clear exploit primitive.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.
Structural signals: smartptr_member_added (+3.0), null_guard (+1.2), msg_soft (+1.0), msg_noise (-2.5), area:Source/WebCore/svg (+2.0), surgical (+1.3)

Before / after

Loading diff…
On This Page