CVE-2025-43435

Overview

Impact:

Description: Processing maliciously crafted web content may lead to an unexpected process crash

Researchers: Justin Cohen of Google

Key insight. The player layer view was destroyed without first detaching and releasing its videoView subview, leaving a dangling reference during media/fullscreen teardown; ordering the subview’s removal and release at the start of dealloc closes the use-after-free window.

Patch Details

diff --git a/Source/WebCore/platform/cocoa/WebAVPlayerLayerView.mm b/Source/WebCore/platform/cocoa/WebAVPlayerLayerView.mm
index 925994716aa1..509b492a0654 100644
--- a/Source/WebCore/platform/cocoa/WebAVPlayerLayerView.mm
+++ b/Source/WebCore/platform/cocoa/WebAVPlayerLayerView.mm
@@ -158,6 +158,11 @@ static void WebAVPlayerLayerView_dealloc(id aSelf, SEL)
 {
     WebAVPlayerLayerView *playerLayerView = aSelf;
 
+    RetainPtr<UIView> videoView = playerLayerView.videoView;
+    [playerLayerView setVideoView:nil];
+    [videoView removeFromSuperview];
+    videoView = nil;
+
 #if HAVE(PICTUREINPICTUREPLAYERLAYERVIEW)
     [playerLayerView setValue:nil forKey:pictureInPicturePlayerLayerViewKey];
 #endif

Background

Advisory: Apple Security Advisory

Terminology

• WebAVPlayerLayerView — A Cocoa view WebCore uses to host AVKit video playback layers in fullscreen/picture-in-picture, owning a videoView subview.
• dealloc — The Objective-C object-destruction method; ordering of subview detachment and reference clearing here determines whether other objects are left with dangling pointers.
• removeFromSuperview — UIView call that detaches a view from its parent’s subview list, breaking the hierarchy retain/reference relationship.
• RetainPtr — A WTF smart pointer that manages a retain/release lifetime for a Cocoa object, used here to hold videoView alive across the controlled teardown steps.
• Use-after-free (UAF) — A memory-safety bug where memory is accessed after being freed, often exploitable if the freed slot can be reallocated with attacker-controlled data.

Root Cause Analysis

WebAVPlayerLayerView is a Cocoa (iOS/media) view used by WebCore’s fullscreen/video playback path; WebAVPlayerLayerView_dealloc is the custom deallocation function for that class. The view owns a videoView subview (accessible via the videoView property) that is added into the view hierarchy as a subview. Before the patch, dealloc tore down other state (e.g. the picture-in-picture player layer view via setValue:nil) but never explicitly detached or released the videoView from the view hierarchy first. The invariant being violated is that a subview which may hold back-references to, or be referenced elsewhere alongside, the layer view must be removed from its superview and cleared before the owning view is destroyed, so that no stale reference to the videoView (or to the dying player layer view through it) survives deallocation. Leaving the videoView attached during dealloc means the subview could remain in the hierarchy / retained by AVKit or layer machinery after its owner is gone, or be torn down in an unexpected order, yielding a use-after-free or inconsistent state when the video/fullscreen teardown races with page-driven destruction. The fix, at the top of dealloc, retains the videoView into a RetainPtr, calls setVideoView:nil to clear the owner’s reference, removeFromSuperview to detach it from the hierarchy, and then drops the RetainPtr (videoView = nil) so the subview is released in a controlled order before the rest of dealloc proceeds. Because the vulnerable ordering/ownership detail lives largely in AVKit and the surrounding fullscreen controller (not shown in this one-file diff), the precise object whose freed memory is later accessed is an inference; what the patch establishes is that videoView was not being cleanly detached and released during the player layer view’s own deallocation, which is consistent with the reported unexpected process crash from malicious web content driving video/fullscreen lifecycle.

Attack Path

1. Load media/fullscreen content

A malicious page embeds video and drives the fullscreen or picture-in-picture path so a WebAVPlayerLayerView with an attached videoView is created.

2. Race or force teardown

Script rapidly enters/exits fullscreen, removes the media element, or navigates so the WebAVPlayerLayerView is deallocated while its videoView subview is still attached and possibly referenced by AVKit/layer machinery.

3. Trigger the buggy dealloc

WebAVPlayerLayerView_dealloc runs without first detaching/releasing videoView, leaving a subview or its holders pointing at now-freed or half-destroyed state (inferred ordering issue).

4. Dangling access

Subsequent layer/AVKit operations or a second teardown touch the stale videoView / player layer view, dereferencing freed memory.

5. Crash (or worse)

The dangling access produces the reported unexpected process crash; a determined attacker who can groom the heap in that process might attempt to convert the UAF into a stronger primitive.

Impact Assessment

The diff shows a lifetime/ownership fix in an Objective-C dealloc that detaches and releases a subview before destroying its owner, which is the classic remedy for a use-after-free or premature-free during teardown; the reported effect is an unexpected process crash. This code runs in the process that hosts media/fullscreen playback (WebContent, or a media/GPU-adjacent context depending on port/configuration), so the corruption is confined to that sandboxed process. Realistically this is a controlled crash / potential UAF; escalation to code execution would require reliable heap grooming to reoccupy the freed object and is not demonstrated by the patch — that escalation reasoning is standard exploitation background, not something the commit establishes.

Audit Directions

Other dealloc paths in the same file/class family

In WebAVPlayerLayerView.mm and sibling AV*View classes, grep for _dealloc and check whether every owned subview/child (pictureInPicturePlayerLayerView, playerLayer, etc.) is detached with removeFromSuperview and cleared before destruction.

videoView lifetime across the fullscreen controller

Grep for setVideoView, videoView, and removeFromSuperview across the fullscreen/PiP controllers to find other holders of the same videoView that may still reference it after this view is gone.

Subview-owning Cocoa views destroyed without detachment

Search platform/cocoa for dealloc implementations that null out ivars but never call removeFromSuperview on owned subviews, a general tell for teardown-ordering UAFs.

Race between page-driven destruction and AVKit callbacks

Audit paths where media element removal / navigation deallocates these views while AVKit or CALayer callbacks may still fire; look for missing weak/RetainPtr guards around videoView/playerLayer access.

Changed Functions

Files Changed

Source Files

• Source/WebCore/platform/cocoa/WebAVPlayerLayerView.mm