6 picks from 393 commits
2026-06-20 – 26
This Week in WebKit — June 20 - June 26, 2026
393
Total commits
6
Security fixes
High 1건, Medium 5건
109
Contributors
Top components
WebCore · WebKit · Other · Platform · JSC
Featured
Security · High
The UI process asked the sandbox which site it was talking to.
Four handlers keyed permission decisions on an origin a compromised renderer supplied. One puts a victim site's name on a prompt the user approves — and the grant it mints redeems elsewhere.
Security · Medium
Two threads, one easing curve, and a reference count that couldn't count.
Four accelerated animations sharing one cubic-bezier can race two threads into losing an increment. What gets freed is polymorphic, and the first use after is a virtual dispatch.
Security · Medium
A frame ID is a name, not a permission — the pasteboard disagreed.
A compromised renderer can name any live frame in the browser as part of its own copy. The UI process serialises that frame's DOM into a pasteboard the attacker named.
Security · Medium
A document at refcount zero is still alive — and still cloneable.
Three lines of script drive a detached document past teardown, then write into a helper it owned. The gap between free and use contains no script at all — which is the interesting part.