We published a new research article: The Frenemies, GC and JIT! In this article, we dive into CVE-2026-112653, a JavaScriptCore DFG bug caused by an unexpected GC safepoint in the NewArrayBuffer allocation path. This breaks the epoch invariant used by StoreBarrierInsertionPhase, causing a required write barrier to be incorrectly elided. We walk through the bug from JIT IR and write-barrier analysis to reliable exploitation: racing JavaScriptCore’s concurrent marker, creating an untracked black-to-white edge, turning it into a GC-induced use-after-free, and ultimately building heap read/write primitives in the WebContent process. We also cover the surprisingly small one-line patch that fixes it. Huge thanks to our team member @m411k_ for conducting this research! Check out the PoC! Full article: https://rewritelab.org/researchs/12/