7 picks from 397 commits
2026-06-13 – 19
This Week in WebKit — June 13 - June 19, 2026
397
Total commits
23
Security fixes
deep-dived: 3 High, 2 Medium, 1 Low
109
Contributors
Top components
WebCore · WebKit · JSC · Other · Platform
Featured
Security · High
Two of four sibling access types never told the collector what they held.
A JIT stub outlives collection by refcount, which is fine until the cell it points at doesn't. Page script builds that cache from any custom accessor; the rest depends on who reclaims the slot.
Security · High
The literal parser knew __proto__ could run script, and guarded the wrong thing.
A plain eval of an object literal hands back a JS object whose declared shape disagrees with its real storage. The guard for this exact hazard was already in that function.
Security · High
The dialog handed back a return value from memory the page just freed.
Attacker-chosen size, attacker-chosen moment — and what lands in dialog.returnValue is script-readable. The free window is a callback the page wrote itself.
Security · Medium
A WebGL buffer offset that host-side code read as a base address.
The page picks the number; the graphics process picks nothing. Realistically it lands as a deterministic crash — what it would take to make it a write is the interesting part.
Development · bug
/\B/u never consumes a character — but it still advanced the match index.
The bad index survives into a string built over out-of-range bounds. One regex from page script is the whole trigger; the surprise is which optimization was still armed.
Security fixes
- Subscriber: teardown callbacks freed while a GC thread walks the snapshot
- ANGLE IndexRange: stored inclusive count replaced by a derived one
Other security-relevant changes
- [WebKit pasteboard proxy] (sandbox bypass)
0d3713d— Fixed authorization bypass in pasteboard IPC: getPasteboardPathnamesForType() checked canAccessPasteboardTypes() (allows during drag-over) instead of canAccessPasteboardData() (allows only at drop), exposing file paths prematurely. - [WebCore RTCEncodedStreamProducer] (type confusion)
8384c84— Adds type validation in RTCEncodedStreamProducer::writeFrame to prevent audio frames from enqueuing on video senders and vice versa, fixing a type confusion that enabled out-of-bounds reads. - [WebKit NetworkProcess] (sandbox bypass)
5ec3ee1— Moved sandbox extension check for local file loads from WebContent to Networking process to prevent circumvention of access restrictions. - [JSC AccessCase] (UAF)
055680a— Adds customSlotBase tracking for CustomAccessorGetter/CustomAccessorSetter in AccessCase, preventing use-after-free when JIT-cached references outlive garbage collection of the slot base. - [WebCore HTMLDialogElement] (UAF)
7075344— Fixed use-after-free in HTMLDialogElement::handleCommandInternal where a beforetoggle event handler could remove a button's value attribute while it was being passed to close(), causing a dangling string reference. - [WebGPU CommandEncoder] (UAF)
5b76a52— Validates that texture views have not been destroyed before using them in render pass setup. Prevents use-after-free when attempting to reference invalidated WebGPU resources. - [JSC Wasm] (UAF)
9a16de4— Fixed use-after-free in Wasm JIT where BBQCallee could die between callsite collection and repatch because Heap::stopThePeriphery() stops JS threads but not Wasm threads. Keeps BBQCallee alive via strong refs to preserve its owned OMGOSREntryCallee. - [WebCore FEColorMatrix] (validator bypass)
b5b06c0— Added IPC-side validation of FEColorMatrixvaluesvector length againsttypebefore decoding, preventing crashes when web content sends mismatched type/values in GPU process messages. - [WebCore Attr] (UAF)
8d71b72— Fixes use-after-free where GC thread dereferenced m_element concurrently with main thread destruction; adds lock and CheckedPtr for cross-thread synchronization. - [WebKit / NetworkProcess] (sandbox bypass)
f10b871— Gated InstallMockContentFilter IPC behind AllowTestOnlyMockContentFilterIPC; a compromised WebContent process could overwrite the process-global MockContentFilterSettings singleton, redirecting or blocking navigations for all NetworkProcess connections. - [WebCore filters/morphology] (race condition)
f076e1a— Fixed race condition in parallel morphology filter where threads accessed shared non-thread-safe PixelBuffer; each job now has separate buffers. - [ANGLE Metal backend] (type confusion)
c9fd4a1— Fixed stale texture format in ANGLE Metal backend — mFormat was incorrectly updated on out-of-range mipmap uploads, causing subsequent GenerateMipmap and render operations to use wrong format against native storage. - [WebCore PlatformScreen] (lifetime fix)
ee05249— Fixed MTE crashes from concurrent HashMap access in PlatformScreen by removing an unnecessary reference variable that was introducing a memory leak. - [WebCore ControlFactory] (UAF)
ab0c1f8— ControlFactory singleton was ref'd/deref'd concurrently from multiple threads but used non-thread-safe RefCounted, causing potential UAF. Fixed by switching to ThreadSafeRefCounted. - [WebKit CoreIPC] (TOCTOU, OOB read)
ca1cd57— Fixed TOCTOU in logOnBehalfOfWebContent where a compromised WebContent process could mutate SharedMemory-backed strings after sending over IPC, removing null terminators and causing OOB reads in UIProcess. Copies spans to CStrings immediately on receipt. - [WebCore Worklets CSP] (CSP bypass)
933debd— AudioWorklet and PaintWorklet scopes were initialized with empty CSP, bypassing restrictions like eval() blocking; now properly inherit creator document's CSP. Also corrected CSP directive check for worklet module fetches to use script-src instead of worker-src. - [WebCore WebGL]
d0000ca— Avoided incorrectly using the client buffer path when reading pixels to PBO with offset, which triggered a crash via wipeAlphaChannelFromPixels.