This Week in WebKit — May 16 - May 22, 2026

423

Total commits

Security fixes

3 High, 3 Medium analyzed in depth; 10 additional triaged in the appendix

113

Contributors

Top components WebCore · Other · WebKit · Platform · JSC

Featured

Security · High

The collector was never told where the exit stub parked its pointers

OSR exit parks live cells in a buffer the collector only scans on request, and the request was never made. The C++ half of the same exit path has always made it.

→ OSR exit scratch buffers were never published to the collector JSC DFG and FTL JITUAF

Security · High

Nine arguments, six registers, and zero bytes reserved for the overflow

The surplus argument lands on a live spill slot of the optimized frame executing the call, carrying a JSValue from a property descriptor. That slot already held a proven type.

→ ObjectDefinePropertyFromFields overran the ABI's argument-register budget JSC DFG and FTL JITOOB

Security · High

A private field read that answers with the prototype's value

obj.#x should throw when the field isn't installed. In DFG-compiled code it could hand back the prototype's copy, and brand checks in JSC's own builtins run through the same routine.

→ GetByStatus walked the prototype chain for direct property access JSC bytecode profiling and DFG JITTypeConfusion

Security · Medium

The unregister call ran, correctly, after everything it protected was gone

C++ destruction order puts the base destructor after the derived members a media callback reads. Getting there needs only an observer that refuses to let the source end.

→ WebRTC incoming sources removed their sink after derived members died WebCore MediaStream (WebRTC)UAF

Security · Medium

A teardown path that added work to the queue it was supposed to drain

The extra entry was pure redundancy, and it named a ticket by an address whose only owner had just been released. TZone reuses that address for the next ticket.

→ DeferredWorkTimer queued duplicate raw tickets during realm teardown JSC runtimeOther

Development · bug

Set spread was proven side-effect-free by a comment, not by a check

A user Symbol.iterator can now run mid-spread, while a structure proof taken before the spread stays alive. Ordinary script decides which slot the JIT reads next.

→ [JSC] Incorrect side-effect modeling for Spread(SetObjectUse) JSC DFG and FTL JIT

Security fixes

RegExp bytecode compilation was racing between mutator and compiler threads
Medium JSC RegExp and YARRRace

Notable development

[Site Isolation] Web Inspector deterministic Network IDs and event routing
feature WebKit Web Inspector
[JSC] Private tmp mechanism in the DFG ByteCodeParser
bug JSC DFG and FTL JIT
[JSC] New DateNow DFG node
optimization JSC DFG and FTL JIT
[JSC] ArrayShift DFG node
optimization JSC DFG and FTL JIT
[JSC] String#match implemented in C++
optimization JSC DFG and FTL JIT
[libpas] Guard page at the front of the compact-heap reservation
hardening bmalloc libpas
[Site Isolation] WebFrameProxy children manipulation and BFCache caching foundations
feature WebKit Site Isolation
Validate identifiers when creating decoders and encoders in LibWebRTCCodecsProxy
hardening WebKit GPU Process WebRTC
[JSC] ScopedArgumentsTable ScopeOffset buffer allocates from fastMalloc
hardening JSC runtimeMemoryCorruption

Other security-relevant changes

[JSC heap] (lifetime fix) d55bf0c — WebAssemblyGCStructure skipped finalization at GC end phase, unlike Structure and BrandedStructure, potentially leaving stale structure state reachable from WebAssembly GC objects. Fix adds the missing finalizeUnconditionally call.
[WebCore AVFoundation] (UAF) 4193d2c — Revokes weak pointers at destructor start to block KVO callbacks from accessing destroyed members (m_logger) during MediaSource teardown, fixing a use-after-free triggered during destruction.
[WebCore webaudio] (UAF) ed04ff4 — Fixed use-after-free in web audio teardown where AudioContext destructor would access Document during its destruction; relocated removeAudioProducer call to earlier teardown phase and added isStopped() guard.
[libvpx VP9 encoder] (overflow) 53c3a3a — Hardens VP9 encoder's vp9_scale_references to fail explicitly with VPX_CODEC_MEM_ERROR when reference frame buffer allocation fails, instead of silently returning. Adds debug assertions in motion search paths to verify scaled reference frames match source dimensions.
[WebCore DOM] (trusted event bypass) fc1ef83 — Fixed untrusted clicks on labels forwarded as trusted to associated form controls, preventing bypass of the trusted-event requirement for switch input haptic feedback.
[WebCore Service Workers] (race condition) 3bce213 — Fixed crash in Service Worker client lookup when internal tracking maps become out-of-sync via a race condition; added end-iterator guards to prevent invalid memory access.
[JSC FTL] (type confusion) 267af1c — Regression test for type confusion where JSC FTL's MultiGetByOffset failed to escape constant values unconvertible to double (functions), allowing them to be mishandled as numbers in ValueRepReduction; edge case in value representation.
[WebCore CSP] (path traversal) 9a19d07 — Changed pathMatches() from full-path percent-decoding to per-segment decoding per CSP3 spec to prevent %2F..%2F bypasses of CSP path restrictions.
[WebCore loader] (protection bypass) d6c7e00 — About:blank popups had empty registrable domains, causing thirdPartyCookieBlockingDecisionForRequest() to return None and skip third-party cookie blocking. Patch makes popups inherit opener's firstPartyForCookies.
[WebCore HTMLPlugInElement] (validator bypass) 7d28e39 — Content extension rules were bypassed for and