306794 2026-02-02 12:18:56 -0800 Crash in WebCore::RemoteCommandListener::supportsSeeking() 2026-02-02 12:37:15 -0800 1 1 1 Unclassified WebKit Media WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 1 ddkilzer ddkilzer webkit-bug-importer oldest_to_newest 2177257 0 ddkilzer 2026-02-02 12:18:56 -0800 WebCore crashes when MediaRemote framework calls through a stale pointer to `RemoteCommandListener::supportsSeeking()`. The crash occurs when: 1. A `RemoteCommandListenerCocoa` object registers a block with MediaRemote framework 2. The object is destroyed but MediaRemote retains the block 3. MediaRemote later executes the block, which accesses freed memory **Stack trace:** ``` 0 WebCore: WebCore::RemoteCommandListener::supportsSeeking() const 1 WebCore: invocation function for block in WebCore::RemoteCommandListenerCocoa::RemoteCommandListenerCocoa 2 WebCore: WebCore::RemoteCommandListenerCocoa::RemoteCommandListenerCocoa 3 MediaRemote: __MRMediaRemoteAddAsyncCommandHandlerBlockForPlayer_block_invoke 4 MediaRemote: MRMediaRemoteAddAsyncCommandHandlerBlock ``` <rdar://162768654> 2177261 1 ddkilzer 2026-02-02 12:37:15 -0800 Pull request: https://github.com/apple/WebKit/pull/4415