Bug Types
Every classified WebKit security fix, grouped by the mechanism at the root of the bug. Classifier taxonomy is fixed at 13 labels — pick one to see every commit of that type across published weeks. 355 labeled fixes total.
Use-after-free. A freed object is accessed after release.
Concurrency race, TOCTOU, data race on shared state.
Missing or incorrect authorization check — IPC handler trusts client identifier, permission not enforced.
Out-of-bounds read or write, buffer overflow, missing bounds check.
Type punning, downcast without check, JIT speculation letting a wrong shape through.
Same-origin policy bypass, cross-origin data disclosure, CSP bypass, cookie/storage leak.
Security-relevant logic error that isn't memory-safety or auth — state machine confusion, wrong redirect.
Doesn't cleanly fit any of the above.
Integer wraparound as the root cause — even when it later manifests as OOB.
Uninitialized read leaking memory content, or use of an uninitialized pointer.
Double-free, arbitrary write not tied to OOB, heap metadata corruption.
Sandbox policy bypass, capability escalation across a process boundary, IPC forgery.
Info leak that isn't primarily cross-origin — memory address leak, timing side channel.