6 picks from 423 commits
2026-05-23 – 29
This Week in WebKit — May 23 - May 29, 2026
423
Total commits
42
Security fixes
deep-dived: 3 High, 3 Medium; 30 further security-relevant changes listed above
102
Contributors
Top components
WebCore · Other · WebKit · JSC · Platform
Featured
Security · High
B3 was right that the value was dead — the collector agreed, and freed it.
Script picks both the freed type and the type that reclaims it. The keepalive that would have prevented this is a convention, not a rule — and one lowering forgot.
Security · High
The DFG certified a property absent from an object that owned it outright.
One object in that proof never got validated: the one it was rooted at. Absence is how the compiler proves no user code can run at a point — so what runs there now?
Security · High
An IC exit undid a stack adjustment that had never happened.
Detach a resizable buffer behind a hot polymorphic byteLength and compiled JS keeps running on a raised stack pointer. The registers it refills come from somewhere worse than garbage.
Security · Medium
The one loop that never got the memo that its own vector reallocates.
A generator and nine million spaces put reads and fixed-value writes into a just-freed buffer — during plain compilation, no JIT warm-up. The comment warning about this was already there.
Security · Medium
IndexedDB handed out other processes' transactions to whoever named them.
The site restrictions guarding which origins you can open never followed the identifiers that came after. Reachable from a compromised renderer — and one assertion already knew.
Security · Medium
The UIProcess looked up the page, then never asked who was asking.
A compromised renderer can post script messages under a page it doesn't host. The one-line check was easy; deciding what "owns" means took the rest of the patch.
Other security-relevant changes
- [JSC FTL] (state restoration fix)
1b42291— Moved FTL stack overflow check to prologue, fixing stack pointer restoration in patchpoint variant to ensure the overflow guard checks stack before frame allocation. - [WebKit NetworkProcess] (hardening)
fb75cae— Added MESSAGE_CHECK validations in setRawCookie IPC handler to ensure cookie.domain and URL match firstParty. Expanded exception handling scope in cookie creation to prevent crashes. - [WebCore date/time input] (UAF)
869d5c5— Use-after-free in date input where changing element type during an input event handler destroys the BaseDateAndTimeInputType object mid-dispatch, then continues using it. Fixed by holding a ref-counted reference through the critical section. - [JSC TypedArray] (TOCTOU)
c852586— Fixed TOCTOU race in TypedArray.sort() on GSAB-backed arrays where separate reads of length and span could drift apart during parallel grow. Now derives both from the same span object. - [JSC DFG] (type confusion)
1f4e4ca— Fixed CSE incorrectly merging String.prototype.at operations with different array modes, conflating string and undefined return cases. - [JSC DFG allocation sinking] (IR correctness)
cdfa73f— Removed unnecessary Check insertion during object allocation sinking that broke exit-state consistency in the DFG graph. - [WebCore SlotAssignment] (UAF)
20beac1— Stale iterator use-after-free in slot assignment resolution: hasAssignedNodes() mutates m_slots while the container iterates over it. Triggered via shadow DOM slot manipulations. Fixed by replacing hasAssignedNodes() calls with direct assignedNodes.isEmpty() checks. - [WebKit ModelProcess] (hardening)
69ff7c4— Replaced ASSERT in createModelPlayer with MESSAGE_CHECK for duplicate-identifier validation; added MESSAGE_CHECK in deleteModelPlayer and unloadModelPlayer to check identifier existence, ensuring release builds reject invalid IPC messages. - [JSC Wasm] (UAF)
76b3468— Prevents a cross-thread use-after-free by unregistering Wasm::InstanceAnchor at the start of JSWebAssemblyInstance destruction. Previously, the anchor could expose a partially-freed instance to the background compiler thread even as its members were being destroyed. - [JSC DFG] (off-by-one)
4e802a1— Corrects BytecodeIndex in reified baseline frames during checkpoint OSR exits; the previously-advanced index caused exceptions thrown in resumed bytecode to route to the wrong exception handler. - [WebCore XMLHttpRequest] (race condition, UAF)
a814080— Fixes race condition in XMLHttpRequest::visitAdditionalChildren() where GC thread dereferences m_responseDocument while main thread may null it; protected all accesses with m_gcLock. - [WebCore Streams] (UAF)
ad57b51— Fixed use-after-free in ReadableStreamDefaultReader where GC-thread code could dereference m_stream after main thread nulled it; addressed with locking. - [JSC string prototype] (hardening)
18a2c9a— Adds exception check after string resolution in replaceAll; without it, an unchecked OOM would allow totalLength and replacementsAre8Bit to be computed from an unresolved string. - [ANGLE Metal] (OOB)
0fe9ff8— Fixed crash in ANGLE Metal's syncDirtyAttrib when vertex attribute offset exceeds buffer size by hoisting GetVertexCount check before conversion branch, guarding both paths. CheckedNumeric rewrite additionally hardens against negative offsets and zero strides. - [JSC TypedArray] (stale pointer)
a271abe— Fixed TypedArray.prototype.forEach to reload the backing vector instead of caching it when the vector can move (ArrayBuffer materialization or Wasm memory reallocation), preventing stale vector pointer reads. - [WebKit NetworkProcess] (hardening)
479f2b4— Replaced RELEASE_ASSERT with MESSAGE_CHECK on IPC identifier validation, preventing a compromised WebContent process from crashing the privileged network process. Now only the attacker-controlled process terminates. - [JSC LiteralParser] (shape confusion)
09c07d2— Fixed LiteralParser incorrectly applying symbol property transitions to string keys, preventing shape confusion in parsed objects. - [JSC B3 optimizer] (JIT miscompilation)
81aa535— Fixed broken dominance check in B3 optimizer that allowed moving add operations into addressing modes despite not dominating all uses; caused incorrect memory address computation in JIT code via typed-array Atomics patterns. - [WebKit UIProcess / WebBackForwardList] (sandbox bypass)
715bc66— Added MESSAGE_CHECK validation for file:// URLs in backForwardUpdateItem and backForwardSetChildItem methods, preventing a compromised WebProcess from injecting unvalidated file URLs into the back-forward list. - [WebCore CSS] (UAF)
5f0480f— Fixed use-after-free in FontFaceSet.load where JS reentrancy via thenable check could remove @font-face rules while still referenced by the loader. Fixed by using Ref instead of reference_wrapper. - [WebKit UIProcess] (origin validation)
23b15df— Missing IPC validation let a compromised WebContent process spoof the address bar by sending arbitrary URLs; fix requires protocol/host/port match current frame's URL. - [JSC JSLock] (race condition)
aed1fdd— Adds acquire-release memory ordering to JSLock::m_hasOwnerThread, fixing a race where threads could observe the flag as true while m_ownerThread remains stale, potentially enabling concurrent unsynchronized JS heap access. - [WebCore PlatformScreen] (race condition)
08911bd— Replaced free-standing PlatformScreen property accessors with a CoW singleton, preventing off-thread concurrent HashMap access that was causing memory safety violations caught by MTE hardware checks. - [WebCore scrolling / Mac] (UAF)
a926a67— Fixed a cross-thread use-after-free crash where NSAnimation display-link callbacks on the scrolling thread could access a ScrollerMac object already destroyed on the main thread. Applied thread-safe ref-counting and enforced main-thread destruction to eliminate the race. - [WebRTC H.264 NALU] (Integer underflow)
86f9503— Added validation that H.264 AVC sequence parameter set NALU size exceeds the NALU prefix, preventing an integer underflow when processing attacker-controlled video via WebCodecs. - [WebCore Streams] (race condition)
597af50— GC thread dereference of m_stream racing with main-thread nulling could cause a use-after-free. Fixed via locking. - [WebKit SpeechRecognitionServer] (hardening)
5db4d93— Replaces ASSERT with MESSAGE_CHECK for duplicate-client validation in SpeechRecognitionServer. ASSERT is a no-op in release builds, allowing duplicate start messages without invariant enforcement; MESSAGE_CHECK now terminates connections. - [bmalloc libpas] (OOB hardening)
ed57dc0— Replaced PAS_ASSERT with bounds checks on compact_heap_reservation_bump, ensuring it falls between guard_size and heap_size. Guards against out-of-bounds memory access during enumeration if compact heap metadata is corrupted. - [JSC WebAssembly] (exception handling)
d8b6307— Missing exception check after OOM during rope-to-string conversion of imported string constants in WebAssembly compile options. Attacker-controlled huge strings in WebAssembly.Module could trigger OOM without proper exception handling, allowing execution to continue with bad state. - [JSC ClonedArguments] (Uninitialized memory)
5099a4a— Fixed loop bound in ClonedArguments::copyToArguments for non-zero offset that left trailing destination array slots unwritten with stale data; no known reachable code path with offset > 0 limits current risk.