◆ WebKit WeeklyBeta
← All reports
14 picks from 417 commits
2026-05-09 – 15

417
Total commits
4건
Security fixes
High 1건, Medium 2건, Low 1건
100명
Contributors
Top components WebCore · Platform · WebKit · JSC · Other

Featured

Security · High
The Metal validator turned an attacker-sized upload into a crash — where it runs.

Five ordinary WebGL calls, no grooming, and the driver gets a region wider than the level it lands on. Where validation is off, both the overrun size and the bytes are the page's to pick.

→ ANGLE Metal: stale texture views survive storage reallocation ANGLE Metal backendUAF
Security · Medium
A modal context menu that never stopped listening to the web process.

A compromised WebContent only has to send its second data-detection result while the first menu is still open. The dangling receiver sits on the privileged side of the sandbox.

→ WebViewImpl: re-entrant IPC frees the modal context-menu presenter WebKit UIProcess (macOS)UAF
Security · Medium
It shipped as a hit-rate fix, on eight cache slots of live CoreGraphics handles.

Any page can route painting into the sampling path; whether two threads land there at once depends on the rendering configuration. What eviction does to the loser's handle is the part to read.

→ GradientRendererCG: process-wide LRU cache mutated from multiple threads WebCore CoreGraphics gradient rendererRace

Security fixes

Notable development

Generated with prompt v1.7.0