Alexey Sokolov
4b88c64c6e
The bug allowed unprivileged users to trigger use-after-free while unloading modules Note that the fix requires a slight API change for OnEmbeddedWebRequest: now the callers (webadmin is the only known caller of it) call it via DoEmbeddedWebRequest() instead. The modules which implement this hook need no changes. CVE-2026-82373 Found by Claude from Anthropic, reported by Ada Logics.