9 picks from 480 commits
2026-05-30 – 06-05
This Week in WebKit — May 30 - June 05, 2026
480
Total commits
25
Security fixes
3 High, 2 Medium, 1 Low analyzed in depth; 19 additional security-relevant changes
104
Contributors
Top components
WebCore · WebKit · Other · JSC · Platform
Featured
Security · High
The CORS policy took a detour through the process it was written to contain.
One IPC message from a compromised renderer, and every site the user is logged into becomes readable. No payload validation could ever have caught it — that's the point.
Security · High
The eval cache kept a raw pointer that nothing was keeping alive.
Reachable from ordinary script, no exotic setup required. The dangling key isn't merely read — it gets stored somewhere that outlives the call, and the timing is winnable.
Security · High
The array that came back from an OSR exit disagreed with itself about its layout.
Script controls both halves of the mismatch, and one of the overlaid slots is a pointer field. The surprise is which of the two lookups went stale.
Security · Medium
The download path took the renderer's word for which site it was on.
A compromised WebContent names any victim as its first party and the SameSite cookies follow. The check couldn't be added unconditionally — that's the interesting part.
Development · bug
A Wasm table slot that was full but looked empty to the collector.
Growing a funcref table from JS is enough to make table.get() hand back a reclaimed cell. The half of the slot that went missing is the half the GC consults.
Security fixes
- Signed integer overflow (UB) in back/forward list index handling
- Masonry fieldset legend passes isSubgrid() despite being excluded from parent grid
Notable development
- App badge IPC sender-origin validation
- [Wasm] OMG tail call patchpoint needs to clobber late pinned registers
Other security-relevant changes
- [WebCore MessagePort] (lifetime fix)
67117c4— Invalidates MessagePorts when Networking process disconnects to prevent stale port identifiers from triggering spoofing detection during normal process restarts. - [WebKit NetworkProcess] (Authorization bypass)
da44cdb— Fixed missing entanglement check allowing a compromised WebContent process to steal pending MessagePort messages from unowned ports; now validates process ownership before returning messages. - [WebKit UIProcess / App Badge] (origin spoofing)
675c62d— Adds origin validation to app badge IPC messages, preventing a compromised web process from spoofing app badges for domains it doesn't control. Checks both window and worker contexts via MESSAGE_CHECK and allowsFirstPartyAccess(). - [WebCore IndexedDB] (UAF)
917854a— IndexedDB HashMap hash/equality mismatch for -0.0 vs +0.0 could delete wrong entries and cause UAF via stale cursor. Also fixes cursor invalidation on abort and IPC validation for version change transaction. - [WebCore IndexedDB] (comparator inconsistency)
d919344— Fixed operator<=> to match operator== for null String and Invalid keys; prevents inconsistency in MemoryIDBBackingStore where HashMap uses operator== and std::set uses operator<=>. - [WebCore Range] (UAF)
1e11f2a— Fixed use-after-free in Range::createContextualFragment where trusted types callbacks could clear range endpoints during execution, leaving stale Node references. - [JSC Baseline JIT] (write-barrier)
1cdc540— Baseline JIT write barrier was firing on wrong value when delete operations likeo = delete o.xoverwrote their source object, corrupting GC write-barrier tracking. - [JSC / WaiterListManager] (race condition)
21ab50e— Fixes data race in WaiterListManager::unregister where target()->realm() reads concurrently-freed m_dependencies; caches JSGlobalObject in Waiter at construction to avoid the racy read. - [WebCore IntersectionObserver] (UAF)
2757278— Fixed use-after-free in IntersectionObserver::updateObservations where removing an Element from m_targetsWaitingForFirstObservation triggered its destructor, which called unobserve and mutated m_observationTargets during iteration. - [JSC Yarr/assembler] (integer overflow)
7663d81— Prevents AssemblerBuffer overflow from pathological RegExp patterns generating >4GB of JIT code; added overflow guard with safe crash path, plus capture and frame size limits to reject excessive patterns before compilation. - [WebCore FrameLoader] (SameSite bypass)
093f346— Prevented SameSite=Strict cookies on cross-site navigations by fixing FrameLoader::load, which unconditionally set isSameSite=true by omitting the initiator document, blocking recomputation in updateRequestAndAddExtraFields. - [WebKit UIProcess / WebPageProxy] (UAF)
1682be9— Fixed use-after-free where WeakPtr objects in completion callbacks failed to keep underlying objects alive. If WebPageProxy or WebProcessProxy is destroyed before the callback executes, freed memory is accessed. Fixed by promoting WeakPtr to RefPtr in navigation and sandbox processing. - [WebKit PCM adattributiond] (sandbox relaxation)
f8277ab— Adds secondary identifier support for PCM request proxying in adattributiond; introduces new entitlements and relaxes iOS sandbox for process-uuid cache access. - [WebKit Safe Browsing] (timing check bypass)
4b574bf— Fixed a timing gap where downloads could bypass safe browsing checks by proceeding before the check response completed, allowing malicious downloads to slip through on timeout. - [WebCore scroll] (reentrancy)
bf80e3e— Prevented viewportContentsChanged() from running during render tree layout, which could query renderer geometry before containing blocks were laid out, causing assertion failures. - [WebCore view transitions] (sandbox bypass)
cc6b337— Fixed a data leak where CSP-sandboxed documents received cross-document view transition state (element names, geometry, rendered content) from the prior page because the same-origin check ran before CSP headers applied. The fix re-validates same-origin after the document's final opaque origin is established. - [JSC IPInt] (stack check)
9161e71— Regression test for WebAssembly IPInt m_maxFrameSizeInV128 computation; exercises varying local counts to verify stack frame size is calculated in v128 units. - [WebKit UIProcess (Permissions)] (hardening)
e118db0— Hardens WebPermissionControllerProxy to terminate a malicious WebProcess instead of crashing UIProcess when permission queries lack identifiers outside SharedWorker or ServiceWorker. - [WebKit Entitlements]
3f1ad2f— Added missing call to initialize sandbox entitlements for WebContent Catalyst variants, fixing crashes when the process attempted to set sandbox state flags.