trop[bot] d80adf4aed fix: prevent use-after-free in permission request callbacks (#50036) ...

EnterFullscreenModeForTab, RequestPointerLock, and RequestKeyboardLock
bind callbacks with base::Unretained(this); fullscreen also captures a
raw RenderFrameHost*. These callbacks may be invoked by the app's JS
permission handler after the WebContents or RenderFrameHost is destroyed.

Use GetWeakPtr() in all three call sites, and capture a
GlobalRenderFrameHostToken instead of the raw RenderFrameHost* for
fullscreen so the pointer is resolved and null-checked only when the
callback fires. Cancel in-flight permission requests from ~WebContents()
via a new ElectronPermissionManager::CancelPendingRequests()` so stale
callbacks are never handed back to JS.

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>

2026-03-02 20:44:50 -08:00

..

app

refactor: address PathProvider TODO (#49601)

2026-02-02 09:39:20 +01:00

browser

fix: prevent use-after-free in permission request callbacks (#50036)

2026-03-02 20:44:50 -08:00

common

fix: offscreen rendering with correct screen info. (#49681)

2026-02-26 11:08:34 -05:00

renderer

fix: potential devtools crash on empty (#49490)

2026-01-22 10:50:59 -05:00

services/node

fix: revert enabling WASM trap handlers in all Node.js processes (#48976)

2025-11-14 18:57:05 -08:00

utility

fix: broken OOP window.print() on macOS/Linux (#45214)

2025-01-20 10:23:44 +01:00