# CVE-2021-30858

WebKit use-after-free in IDBOpenDBRequest: a script-dispatched custom event on an IndexedDB request frees it while a cross-thread task holds a raw reference.

- Payout: Real-world hack
- Severity: high
- Program: Apple WebKit
- Credited: Anonymous
- Disclosed: 2021-09-13
- CVE: CVE-2021-30858
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-30858.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-30858
- Tags: domain:browser impact:rce kind:incident platform:project-zero sev:high technique:regression technique:source-review vuln:memory-corruption

**Target:** WebKit IndexedDB IDBOpenDBRequest / CrossThreadTask
**Root cause:** createCrossThreadTask selected the raw-reference template because IDBOpenDBRequest derives from ThreadSafeRefCounted<IDBRequest>, not ThreadSafeRefCounted<IDBOpenDBRequest>; dispatchEvent on an untrusted custom event mutated request state, freeing the object early.
**Steps:**
1. Create `w = new Worker('idbworker.js')`
2. In worker: `req = indexedDB.open('db')`
3. Dispatch a script-generated custom event: `req.dispatchEvent(new Event('mine'))`
4. Null out `req` and `ev` references
5. Force GC by allocating many `new Uint8Array(1024*1024)` in a loop
6. Cross-thread task later dereferences the freed IDBOpenDBRequest via raw reference
**How found:** Project Zero assesses it was most likely found via fuzzing (common trigger patterns), or by variant analysis of similar prior Chrome/WebKit IndexedDB UAFs.
**Exploitation:** No exploit sample available; UAF of IDBOpenDBRequest reachable from web content, exploited in the wild as a zero-day (likely within an exploit chain).
**Insight:** When auditing ref-counted cross-thread task templates, check that the SFINAE trait matches the exact template argument: a derived class inheriting ThreadSafeRefCounted<Base> silently falls into the raw-pointer overload. Also grep dispatchEvent handlers that mutate state on untrusted events.