← WebKit — 2026-W37
7737c68ff27119f121322fb9d7f745584315d922 [Site Isolation] Disconnect remote intersection observers when owning document is destroyed
severity low
class UAF
confidence 0.4
signal score 6.3
Source/WebCore/dom
Primitive: Remote intersection observers were not disconnected at Document teardown, potentially leaving them registered against a destroyed document.
Triage note: Document::commonTeardown() now disconnects m_remoteIntersectionObservers (mirroring the existing local-observer loop) and the destructor adds ASSERTs that both observer sets are empty. The disconnect is a real lifetime cleanup, but the change is dominated by diagnostic ASSERTs and no concrete exploit path is shown in-diff.
Triage note: Document::commonTeardown() now disconnects m_remoteIntersectionObservers (mirroring the existing local-observer loop) and the destructor adds ASSERTs that both observer sets are empty. The disconnect is a real lifetime cleanup, but the change is dominated by diagnostic ASSERTs and no concrete exploit path is shown in-diff.
Structural signals: smartptr_member_added (+3.0), area:Source/WebCore/dom (+2.0), surgical (+1.3)
Commit message
[Site Isolation] Disconnect remote intersection observers when owning document is destroyed
https://bugs.webkit.org/show_bug.cgi?id=323814
rdar://187055922
Reviewed by Kiet Ho.
308143@main split the document's vector of IntersectionObservers in to a local and a remote
vector. However, it only disconnected the local observers when the document was destroyed. We should
also disconnect the remote observers.
Test: http/tests/site-isolation/intersection-observer/remote-observer-document-leak.html
* LayoutTests/http/tests/site-isolation/intersection-observer/remote-observer-document-leak-expected.txt: Added.
* LayoutTests/http/tests/site-isolation/intersection-observer/remote-observer-document-leak.html: Added.
* LayoutTests/http/tests/site-isolation/intersection-observer/resources/remote-observer-document-leak-frame.html: Added.
* LayoutTests/http/tests/site-isolation/intersection-observer/resources/remote-observer-document-leak-subframe.html: Added.
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::~Document):
(WebCore::Document::commonTeardown):
Canonical link: https://commits.webkit.org/320838@main
Before / after
Loading diff…
On This Page