UAF
91 commits
Use-after-free. A freed object is accessed after release.
2026-W33 2026-08-15 – 21
2026-W32 2026-08-08 – 14
2026-W31 2026-08-01 – 07
2026-W28 2026-07-11 – 17
- [AppKit Gestures] Fix incorrect logic in `PositionInformationManager::invokeAndRemovePendingHandlers` that could result in a reentrancy UAF
- REGRESSION(316617@main): Use-after-free in IPC::Connection::SyncMessageState::~SyncMessageState()
- WebSpeechSynthesisWrapper crashes on voice change notification
2026-W27 2026-07-04 – 10
- Complex text path should retain the system fallback fonts it uses
- ANGLE: Metal: Dangling mOcclusionQuery pointer if visibility buffer allocation fails
- [CoreIPC] [GPUP] Nested DrawDisplayList Replay Falls Back to ControlFactory::singleton() Leads to Concurrent NSCell UAF
- SVGProperty::contextElement after stopAnimation drops m_animVal without detach()
2026-W26 2026-06-27 – 07-03
- Use-after-free in LocalFrameView::scrollToAnchorFragment via NavigateEvent:finish
- Use-after-free in CSSFontFace::setStatus via CSSFontFace::load
- [WebCore] Unconditionally pin AudioBuffer data in AudioBufferSourceNode::setBufferForBindings
- [WebXR] Use-after-free of WebXRSystem in callbacks re-posted from ensureImmersiveXRDeviceIsSelected
- [JSC] DeferredWorkTimer should vend Weak references to Tickets
- UAF in WebContent due to Cross-thread destruction race of worker DeferredPromise via Permissions::query() + worker.terminate()
- Heap use-after-free of XSLStyleSheet::m_stylesheetDoc after libxslt frees imported doc on compile failure
- Use-after-free in FocusController::findAndFocusElementInDocumentOrder
- [WebKit] Use-after-free in ServiceWorkerDownloadTask via stale FunctionDispatcherQueue after second EstablishSWContextConnection
- Safari & Chrome for iOS: Use-after-free in WebKit libwebrtc `RtpTransceiver` codec state reachable via `RTCRtpTransceiver.setCodecPreferences` after garbage-collected `RTCPeerConnection`
- Use-after-free in WebPageProxy::sendToWebPage from off-main-thread WKMarketplaceKit completion (interceptMarketplaceKitNavigation)
- [JSC] Override isValid() on AdaptiveValuePropertyInlineCacheClearingWatchpoint
- heap-use-after-free in WebExtensionRegisteredScriptsSQLiteStore::addScripts
- Heap use-after-free in ClipboardItemBindingsDataSource::clearItemTypeLoaders()
- Use-after-free of Document in trustedTypeCompliantString
- Use-after-free in HistoryController::recursiveGoToItem — popstate-reentrant setChildItem reallocates iterated m_children
- Cross-Thread UAF Write in AsyncFileStream::read via NetworkDataTaskBlob
- REGRESSION(298821@main): [iOS] RequestPointerLock IPC twice in succession can produce use-after-free of unretained GCMouseMoved block in WKMouseInteraction
- Use-after-free in XRSessionInit dictionary conversion via sequence<any>
- Use-after-free on SecurityOrigin in NavigationScheduler::scheduleLocationChange
- [WebXR] Use-after-free when ending an XRSession whose owning WebXRSystem has been garbage collected
- [WebCore] Use-after-free in InternalAudioEncoderCocoa on ASBD change because converter->finish() promise is discarded
- Heap UaF in GPU Process via MediaStreamTrack.clone() + ImageCapture.takePhoto() + applyConstraints()
- [JSC][FTL] compileArrayIndexOfOrArrayIncludes (UntypedUse + Array::Contiguous): ensureStillAliveHere(base) placed before GC-capable vmCall
- [WebCore] use-after-free in Style::TreeResolver — XMLDocumentParser::startElementNs missing parentNode re-check after custom-element upgrade
- Use-after-free in SVGGeometryElement::getPointAtLength — raw renderer pointer held across nested updateLayout
- [JSC] Insert barrier for MultiPutByOffset when it can reallocate storage
- [WebKit Process Model] Use-after-free in WebExtensionContext::storageSet from HashMap mutation during keys() iteration
- use-after-free in WebCodecsAudioData::memoryCost() via concurrent GC marker / close()
- [JSC] Unconditionally keep OMGOSREntryCallee alive while updating its callsites
- [CoreIPC] [NP] Heap UAF in WebCore::IDBServer::MemoryIndexCursor reverse iterator when a Prev/Prevunique cursor's next-higher index entry is deleted
- Use-after-free under WebsiteDataStore::beginAppBoundDomainCheck()
- Crash in CanvasRenderingContext::deref after reentrant getContext()
- Use-after-free in AutoFillButtonElement::defaultEventHandler
- [JSC] Keep JSWebAssemblyMemory alive from wasm-originated JSArrayBuffers
- [JSC] Use-after-free after Wasm memory grow via stale pointer folded by DFGConstantFoldingPhase
- [WebCore] Heap-use-after-free in EventRegionContext::shrinkWrapInteractionRegions when m_interactionRegions.insert reallocates under a held reference
- use-after-free in CloseWatcher::destroy(): abort-signal algorithm calls destroy() via WeakPtr while CloseWatcherManager holds the last Ref
- [WebCore] heap use-after-free in SWClientConnection::updateBackgroundFetchRegistration due to live HashTable iterator invalidation during synchronous progress event dispatch
- [web-animations] use-after-free in AnimationTimelinesController::suspendAnimations: m_timelines rehashes during iteration when DocumentTimeline::suspendAnimations forces layout
2026-W25 2026-06-20 – 26
2026-W24 2026-06-13 – 19
- [JSC] Track customSlotBase for CustomAccessorGetter/CustomAccessorSetter
- Use-after-free in HTMLDialogElement::close
- Check for destroyed
- Use-after-free of StreamingCompiler::m_ticket
- [JSC] BBQCallee should be kept alive between callsite collection and repatch
- Potential use-after-free under JSAttr::visitAdditionalChildren()
2026-W23 2026-06-06 – 12
- REGRESSION: Use-after-free in Node::m_shadowIncludingRoot via destructor cascade not propagating into shadow roots
- Use-after-free in Element::dispatchBlurEvent
- [WebRTC] Heap-use-after-free in `DtlsTransportInternalImpl` when RTCP-mux is negotiated after initial non-mux session
- Potential use after free of m_controller under ReadableStreamBYOBRequest::visitAdditionalChildren()
- WebSWClientConnection::notifyRecordResponseBodyChunk uses a HashMap iterator across an arbitrary callback
- WebGL: Crash in EXTDisjointTimerQuery::queryCounterEXT task
- Heap needs to protect swaped JSString Impls for GCOwnedDataScope
- REGRESSION(305413.674@safari-7624-branch): Crash in StreamPipeToState::globalObject
- Heap use-after-free in Node::rootNode via stale m_shadowIncludingRoot
2026-W22 2026-05-30 – 06-05
- [IndexedDB] Use-After-Free caused by use of `-0.0` for HashMap Key
- Use-after-free of Node in Range::createContextualFragment
- [intersection-observer] IntersectionObserver::updateObservations could modify m_observationTargets when iterating through it
- [JSC] Defer GC while using the direct eval CacheLookupKey
2026-W21 2026-05-23 – 29
- Use-After-Free in `BaseDateAndTimeInputType::didChangeValueFromControl`
- Use-after-free in NamedSlotAssignment::resolveSlotsAfterSlotMutation
- [JSC] Wasm::InstanceAnchor should be unregistered at the prologue of JSWebAssemblyInstance destructor
- Crash in -[WebScrollbarPartAnimationMac setCurrentProgress:]
- Potential use after free of m_responseDocument in XMLHttpRequest::visitAdditionalChildren()
- Potential use after free of m_stream in ReadableStreamDefaultReader::visitAdditionalChildren()
- [JSC] ExpressionInfo::Encoder::adjustInstPC should take an index instead of a pointer
- Potential use after free of m_stream in ReadableStreamBYOBReader::visitAdditionalChildren()
- Cherry-pick 305413.459@safari-7624-branch (6b53aa44e133). rdar://176061288
- Cherry-pick 305413.664@safari-7624-branch (db05eacaeb0c). rdar://176058395
2026-W20 2026-05-16 – 22
- [JSC] Scan OSR exits' ScratchBuffers
- REGRESSION (301011@main): Crash in MediaPlayerPrivateMediaSourceAVFObjC::setNetworkState during destruction
- Don't call document->removeAudioProducer during Document destruction
- Fix crashes in RealtimeIncoming*Source destructors by ensuring sink removal before member destruction