LogicError
31 commits
Security-relevant logic error that isn't memory-safety or auth — state machine confusion, wrong redirect.
2026-W32 2026-08-08 – 14
2026-W29 2026-07-18 – 24
2026-W26 2026-06-27 – 07-03
- [JSC] getByIdMegamorphic needs a throw scope
- [WebCore] unchecked exception return in ReadableByteStreamController::closeAndRespondToPendingPullIntos and TeeDefaultReadRequest::runCloseSteps
- Compromised Web Content can use a navigation-response Download policy on a data: URL to write attacker-controlled bytes to disk
- Cherry-pick ef8d2c8530b9. rdar://175672652
- [web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash
- Local file loads should always be checked in NetworkResourceLoader::startNetworkLoad
- Clear stale imageDef in TextureMtl::redefineImage fast path
- Streaming compiler does not reject mixed legacy and spec-correct EH
- ANGLE: ResumeTransformFeedback does not validate the active program
- Stored XSS on bugs.webkit.org in Commits extension; fix guidance (escape captured groups; optionally tighten \S+)
- Reject IndexedDB transactions during version change operation
- ANGLE: Metal: Inconsistent implementation of various DrawElements variations
- Reject requestStorageAccess() without gesture should not synthesize user activation
- [WebKit Process Model | All] Wrong-container end() comparison in WebFrameProxy::nextSibling/previousSibling
- [WebGPU] Reject duplicate binding entries in Device::createBindGroup
2026-W23 2026-06-06 – 12
- Before creating a remote AVF image decoder, the mime-type should be checked if it is supported
- Same user gesture can be used for both opening a window and focussing previous one
- Show safe browsing warning immediately when lookup completes
2026-W22 2026-05-30 – 06-05
- We should wait until we get a safe browsing response before proceeding with downloads
- [grid layout] Don't call viewportContentsChanged() from scroll updates during render tree layout
- [IndexedDB] IDBKeyData operator== and operator<=> define different equivalence classes
2026-W21 2026-05-23 – 29
- postMessage can indefinitely extend the lifetime of a user gesture token
- postMessage can indefinitely extend the lifetime of a user gesture token
- [JSC] Don't advance bytecode when reifying inline frames at a checkpoint
- replaceAllWithCacheUsingRegExpSearchThreeArguments fails to throw exception in string resolution
- Don't let ServiceWorkers handling push events call showNotification but then immediately close that notification
2026-W20 2026-05-16 – 22
- Content extensions should block plugin loads from embed and object elements
- Haptic feedback for <input type=checkbox switch> can be triggered with a programmatic click on an associated label