← WebKit — 2026-W41
7efb1f141dd0507f8da758fbb540a13b8d5cde0d Web Inspector: InspectorDOMAgent should remove EventFiredCallbacks on reset
severity low
class UAF
confidence 0.3
signal score 6.82
Source/WebCore/inspector
Primitive: inspector media event listeners not removed on frontend disconnect
Triage note: InspectorDOMAgent now stores a single m_eventFiredCallback and removes the media/fullscreen event listeners (and stops the media-metrics timer) in willDestroyFrontendAndBackend, instead of creating a fresh callback per node and never detaching it. This fixes dangling inspector listeners, but it is only reachable with Web Inspector attached, so it is not attacker-reachable from web content.
Triage note: InspectorDOMAgent now stores a single m_eventFiredCallback and removes the media/fullscreen event listeners (and stops the media-metrics timer) in willDestroyFrontendAndBackend, instead of creating a fresh callback per node and never detaching it. This fixes dangling inspector listeners, but it is only reachable with Web Inspector attached, so it is not attacker-reachable from web content.
Structural signals: smartptr_member_added (+4.87), null_guard (+1.95)
Commit message
Web Inspector: InspectorDOMAgent should remove EventFiredCallbacks on reset
https://bugs.webkit.org/show_bug.cgi?id=301193
<rdar://problem/163570267>
Reviewed by Timothy Hatcher.
Create a single `EventFiredCallback`/`EventListener` instead of a separate instance for each node.
Remove that single shared instance from nodes when Web Inspector is closed.
* Source/WebCore/inspector/agents/InspectorDOMAgent.h:
* Source/WebCore/inspector/agents/InspectorDOMAgent.cpp:
(WebCore::forEachInspectedNodeEventName): Added.
(WebCore::InspectorDOMAgent::willDestroyFrontendAndBackend):
(WebCore::InspectorDOMAgent::addEventListenersToNode):
Canonical link: https://commits.webkit.org/323273@main
Before / after
Loading diff…
On This Page