◆ WebKit WeeklyBeta
← All reports
15 picks this week
2026-05-02 – 08

This Week in WebKit — May 02 - May 08, 2026

467
Total commits
5
Security fixes
1 High, 3 Medium, 1 Low
110
Contributors
Top components WebCore · Platform · WebKit · JSC · Other

Featured

Security · High
A stylesheet and one getComputedStyle() call read freed token storage.

The resolver already carried a lifetime anchor for exactly this hazard; CSS Mixins arrived without one. Past the crash, everything depends on who gets the freed slab first.

→ CSS @function substitution drops the CustomProperty backing its own tokens WebCore StyleUAF
Security · Medium
The object-src spelling that looks like deny-all was the permissive one.

CSP Level 3 says an empty source list and 'none' forbid the same thing. On a URL-less <object>, one of them was still answering to a superseded draft.

→ CSP empty object-src source list treated as permissive for URL-less plugins WebCore Content Security Policy enforcementCrossOrigin
Security · Medium
The GPU process let the renderer vote on which draft extensions it could use.

A preference decided how much ANGLE a renderer can reach inside the GPU process — and only the untrusted side ever read it. Asking for the draft extension was enough.

→ WebGL draft-extension setting never reached the GPU process WebKit GPU processLogicError
Development · bug
A Memory64 address of 2^32 looked like address 0 to the bounds check.

The out-of-bounds trap is the whole of memory safety for this instruction, and a wrapped address never reached it. The upper 32 bits go missing between the fast path and the slow path.

→ [JSC] IPInt slow path for `memory.atomic.notify` truncates the Memory64 pointer and offset to 32 bits JSC
Development · bug
strict-dynamic checks scripts twice — external modules were only checked once.

Classic scripts and inline modules pass both gates; external modules only ever reached the second. The second one was written to defer to the first.

→ CSP strict-dynamic does not block parser-inserted external module scripts WebCore Content Security Policy enforcement

Security fixes

Notable development

Generated with prompt v1.7.0