LogicError
46 commits
Security-relevant logic error that isn't memory-safety or auth — state machine confusion, wrong redirect.
2026-W39 2026-09-26 – 10-02
- Respect zero intrinsic size for SVG in object/embed elements
- Enabling remote snapshotting causes two PDF drawing API tests to fail
- [LBSE] A SMIL animated 'viewBox' has no effect on the outermost <svg> element
2026-W38 2026-09-19 – 25
- [GFC] Take a grid item's fit-content block size from its layout rather than measuring it separately.
- Use requesting origin instead of active origin for Geolocation permission prompt
2026-W37 2026-09-12 – 18
- Validate numberOfFrames in SpeechRecognitionRemoteRealtimeMediaSourceManager::remoteAudioSamplesAvailable
- A float inside an inline box can be positioned twice when the line it was collected with is discarded
- REGRESSION(320327@main) webgl/*/conformance/textures/misc/tex-image-with-format-and-type.html fail
- [cocoa] WebTransport is not marking connections
2026-W36 2026-09-05 – 11
2026-W35 2026-08-29 – 09-04
- Trusted Types enforcement in Document.execCommand should be case-insensitive
2026-W34 2026-08-22 – 28
- REGRESSION(319888@main): [AppKit Gestures] Cannot back/forward navigate with gesture-driven swipe
- ANGLE: Metal: EnsureLoopForwardProgress infinite loops with unsigned tautology compare classified as finite
2026-W32 2026-08-08 – 14
2026-W29 2026-07-18 – 24
2026-W26 2026-06-27 – 07-03
- [JSC] getByIdMegamorphic needs a throw scope
- [WebCore] unchecked exception return in ReadableByteStreamController::closeAndRespondToPendingPullIntos and TeeDefaultReadRequest::runCloseSteps
- Compromised Web Content can use a navigation-response Download policy on a data: URL to write attacker-controlled bytes to disk
- Cherry-pick ef8d2c8530b9. rdar://175672652
- [web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash
- Local file loads should always be checked in NetworkResourceLoader::startNetworkLoad
- Clear stale imageDef in TextureMtl::redefineImage fast path
- Streaming compiler does not reject mixed legacy and spec-correct EH
- ANGLE: ResumeTransformFeedback does not validate the active program
- Stored XSS on bugs.webkit.org in Commits extension; fix guidance (escape captured groups; optionally tighten \S+)
- Reject IndexedDB transactions during version change operation
- ANGLE: Metal: Inconsistent implementation of various DrawElements variations
- Reject requestStorageAccess() without gesture should not synthesize user activation
- [WebKit Process Model | All] Wrong-container end() comparison in WebFrameProxy::nextSibling/previousSibling
- [WebGPU] Reject duplicate binding entries in Device::createBindGroup
2026-W23 2026-06-06 – 12
- Before creating a remote AVF image decoder, the mime-type should be checked if it is supported
- Same user gesture can be used for both opening a window and focussing previous one
- Show safe browsing warning immediately when lookup completes
2026-W22 2026-05-30 – 06-05
- We should wait until we get a safe browsing response before proceeding with downloads
- [grid layout] Don't call viewportContentsChanged() from scroll updates during render tree layout
- [IndexedDB] IDBKeyData operator== and operator<=> define different equivalence classes
2026-W21 2026-05-23 – 29
- postMessage can indefinitely extend the lifetime of a user gesture token
- postMessage can indefinitely extend the lifetime of a user gesture token
- [JSC] Don't advance bytecode when reifying inline frames at a checkpoint
- replaceAllWithCacheUsingRegExpSearchThreeArguments fails to throw exception in string resolution
- Don't let ServiceWorkers handling push events call showNotification but then immediately close that notification
2026-W20 2026-05-16 – 22
- Content extensions should block plugin loads from embed and object elements
- Haptic feedback for <input type=checkbox switch> can be triggered with a programmatic click on an associated label