This Week in WebKit — June 20 - June 26, 2026
Featured
Four handlers keyed permission decisions on an origin a compromised renderer supplied. One puts a victim site's name on a prompt the user approves — and the grant it mints redeems elsewhere.
Four accelerated animations sharing one cubic-bezier can race two threads into losing an increment. What gets freed is polymorphic, and the first use after is a virtual dispatch.
A compromised renderer can name any live frame in the browser as part of its own copy. The UI process serialises that frame's DOM into a pasteboard the attacker named.
Three lines of script drive a detached document past teardown, then write into a helper it owned. The gap between free and use contains no script at all — which is the interesting part.
A third-party tracker's WebSocket handshake carried cookies ITP had already taken away. No compromise, no preconditions — only a different place to open the socket.