TypeConfusion 33 commits

Type punning, downcast without check, JIT speculation letting a wrong shape through.

2026-W32 2026-08-08 – 14

2026-W31 2026-08-01 – 07

2026-W30 2026-07-25 – 31

2026-W29 2026-07-18 – 24

2026-W28 2026-07-11 – 17

2026-W26 2026-06-27 – 07-03

  • Type confusion in ReadableStream.cancel() via jsCast<JSPromise*>
    WebCore 87d203651d 2026-07-03
  • Guard against MessagePort confusion in the Network Process
    WebKit 899dd99924 2026-07-02 ↑ boundary
  • Type confusion via raw Exception cell returned to script from callPromisePairFunction when throwVMError bypasses sentinel check
    JSC e75354878c 2026-07-01
  • putPixelBuffer() and getPixelBuffer() should never be called for PDF and DisplayList ImageBufferBackends
    WebCore 6a20a3d210 2026-07-01 ↑ boundary
  • m_bufferMapCount via getMappedRange State Confusion Leads to GPU OOB
    WebKit ce589a4f52 2026-07-01 ↑ boundary
  • WasmGC should reject reserved bits in br_on_cast/br_on_cast_fail flags byte
    JSC 5df8b0b81b 2026-07-01
  • [web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash
    WebCore 699f1cad2c 2026-06-30
  • [WebCore] TransformStream type confusion when Array.prototype[Symbol.iterator] is overridden
    WebCore 8fd92b1021 2026-06-30 CVE-2026-43705
  • [JSC] Do not cache property absence on dictionaries
    JSC d75a9fda98 2026-06-30
  • [JSC] Stale structure bit in SlowPutArrayStorage
    JSC 336c35e2c1 2026-06-30
  • [WebCore][bindings] Empty JSValue returned to script from callPromisePairFunction when argument conversion throws
    WebCore 6ea1f0a2bf 2026-06-30
  • [WebGPU] Stale WeakPtr comparison in BindGroupLayout::errorValidatingBindGroupCompatibility allows incompatible auto/explicit layout pairing
    WebGPU aad3188c8a 2026-06-30 ↑ boundary

2026-W24 2026-06-13 – 19

2026-W23 2026-06-06 – 12

2026-W22 2026-05-30 – 06-05

2026-W21 2026-05-23 – 29

2026-W20 2026-05-16 – 22

2026-W18 2026-05-02 – 08