114
Security bugs analyzed
130
Dev commits covered
44
WebKit CVEs covered
23
Weekly reports
244
Contributors
This week's picks
Of the 686 WebKit commits landed this week, we selected 12 for close analysis.
W40
October 03 - October 09, 2026
A WebGL2 page could get the GPU process to paint stale heap where its frame belonged.
2 security
10 dev
Read this week's report →
Browse all reports →
CVE coverage
One report per CVE. If a CVE is assigned to a commit that wasn't analyzed in a weekly report, an additional report is published.
- CVE-2026-84635 Processing maliciously crafted web content may lead to an unexpected process termination
- CVE-2026-64753 Processing maliciously crafted web content may disclose sensitive user information
- CVE-2026-86898 Opening a maliciously crafted webarchive file may lead to universal cross-site scripting
- CVE-2026-64784 Processing maliciously crafted web content may lead to an unexpected Safari crash
Live activity
Security bug types · 15-week window
396 security fixes · browse all
Where bugs land · component × bug type
15-week window · darker = more fixes
Report activity — selectivity
Weekly picks
Outlier (±1σ)
Average: 2.2% of commits analyzed
Commit activity
WebCoreWebKitJSCWTFWebInspectorOther
Security · Hardening