From e6332ac121b35a1f26c0f2e49f7a5cdee4d8fb83 Mon Sep 17 00:00:00 2001
From: Karl Seguin <k@openmymind.io>
Date: Sat, 30 May 2026 08:44:35 +0800
Subject: [PATCH] Close session before freeing notification

With the new CookieStore, the session must be freed before the notification is.
This is how it works in CDP, but in fetch, we were pretty lazy about it. This
caused the notification to be freed first, and then the cookiestore to try to
unregister: UAF.
---
 src/lightpanda.zig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/lightpanda.zig b/src/lightpanda.zig
index 155ccd4b..83214b4c 100644
--- a/src/lightpanda.zig
+++ b/src/lightpanda.zig
@@ -67,6 +67,7 @@ pub fn fetch(app: *App, browser: *Browser, url: [:0]const u8, opts: FetchOpts) !
     defer notification.deinit();
 
     var session = try browser.newSession(notification);
+    defer browser.closeSession();
 
     if (app.config.cookieFile()) |cookie_path| {
         cookies.loadFromFile(session, cookie_path);