Skip to content

fix(macos): prevent use-after-free in stop_task on macOS 11 during WKWebView dealloc #1734

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
x93008 wants to merge 2 commits into
base: dev
Choose a base branch
from
+16 −5
Open

fix(macos): prevent use-after-free in stop_task on macOS 11 during WKWebView dealloc #1734

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4ab4624
fix(macOS 11): prevent UAF crash in WKURLSchemeHandler stop_task
x93008 May 20, 2026
9be1a6b
chore: add change file for macOS 11 stop_task UAF fix
x93008 May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changes/fix-macos11-stop-task-uaf.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"wry": patch
---

On macOS 11, fix use-after-free crash in custom protocol `stop_task` during WKWebView dealloc by using raw pointers instead of objc2 references and enforcing correct drop ordering in the async response handler.
16 changes: 11 additions & 5 deletions src/wkwebview/class/url_scheme_handler.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -286,12 +286,18 @@ extern "C" fn start_task(
}))
.map_err(|_e| crate::Error::CustomProtocolTaskInvalid)?;

if WEBVIEW_STATE.read().unwrap().contains_key(webview_id) {
let result = if WEBVIEW_STATE.read().unwrap().contains_key(webview_id) {
webview.remove_custom_task_key(task_key);
Ok(())
} else {
Err(crate::Error::CustomProtocolTaskInvalid)
}
};

// webview must drop before task: if webview drop triggers dealloc →
// stopAllTasksForPage → platformStopTask, the task must still be alive.
drop(webview);
drop(task);
result
}

#[cfg(feature = "tracing")]
Expand Down Expand Up @@ -334,8 +340,8 @@ extern "C" fn start_task(
extern "C" fn stop_task(
_this: &ProtocolObject<dyn WKURLSchemeHandler>,
_sel: objc2::runtime::Sel,
webview: &WryWebView,
task: &ProtocolObject<dyn WKURLSchemeTask>,
_webview: *mut AnyObject,
_task: *mut AnyObject,
) {
webview.remove_custom_task_key(task.hash());
// no-op: avoid accessing task/webview — macOS 11 may pass freed pointers here
}