WebKit security + dev commits, analyzed each week
Read this week's reportOf 765 WebKit commits landed this week, 11 made the cut for in-depth analysis. Browse all reports →
Every WebKit CVE gets a report
40 covered to date — including the ones landed on commits outside that week's picks, where we publish a dedicated report so nothing slips through. See all →
Processing maliciously crafted web content may lead to an unexpected process termination
Processing maliciously crafted web content may disclose sensitive user information
Opening a maliciously crafted webarchive file may lead to universal cross-site scripting
Processing maliciously crafted web content may lead to an unexpected Safari crash
Processing maliciously crafted web content may lead to an unexpected Safari crash
Processing maliciously crafted web content may lead to memory corruption
Processing maliciously crafted web content may lead to an unexpected process crash
Processing maliciously crafted web content may lead to an unexpected Safari crash
Processing maliciously crafted web content may lead to an unexpected Safari crash
Processing maliciously crafted web content may lead to memory corruption
Processing maliciously crafted web content may lead to an unexpected process termination
Websites may know if the user has visited a given link
Live view of the WebKit tree
24 weekly reports · 115 security bugs · 140 dev commits · 40 CVEs · 248 contributors tracked.
Security bug types · 15-week window
How frequently the pipeline sees each bug class (UAF, type confusion, race, OOB, …) in the last 15 weeks. Longer bars = more common bug class.
Where bugs land · component × bug type
Which WebKit components produce which bug classes. Rows = components, columns = bug types; darker cells concentrate more fixes of that class in that component.
Report activity — selectivity
How selective the pipeline is each week. One dot per week at (total commits landed, picks analyzed); the dashed line is the average pick rate. Dots above the line are heavy-analysis weeks.
Commit activity
Weekly WebKit commit volume, segmented by top components. The paired right-hand bar isolates how many of those commits were security fixes or hardening changes.