Code: scoped_refptr<BrowserContext> BrowserContextImpl::GetOffTheRecordContext() {
   if (!otr_context_) {
    OTRBrowserContextImpl* context = new OTRBrowserContextImpl(
        this,
        static_cast<BrowserContextIODataImpl *>(io_data()));
    otr_context_ = context->GetWeakPtr();
   }
 
  return make_scoped_refptr(otr_context_.get());
 }

Vulnerability Type: 
CWE ID: CWE-20
Summary: A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before 1.18.3.
Commit Message: 