This Week in WebKit — July 04 - July 10, 2026

447

Total commits

Security fixes

4 High, 1 Medium, 1 Low analyzed in depth; 3 additional security-relevant

113

Contributors

Top components WebCore · WebKit · Other · Platform · JSC

Featured

Security · High

The per-thread isolation held at every level except the one that made levels.

A compromised renderer wraps control drawing one layer deeper, and four GPU-process threads land on the same AppKit cells. The fallback is deterministic; the interleaving isn't.

→ Nested DrawDisplayList replay falls back to the singleton ControlFactory WebCore display-list replayUAF

Security · High

Overwriting a callback was a free, and a real-time thread was inside it.

Sent twice from a compromised renderer, a create-once GPU message drops every owner of a live audio bridge. A real-time thread is still executing inside it.

→ Replayed CreateAudioSourceProvider drops the provider mid-callback WebKit GPU process media pipelineAuthBypass

Security · High

Three code paths dropped the pointer. Only the destructor remembered to detach.

Script holds the animVal long after its owner is gone, and the back-pointer never learned. The page picks the moment to dereference — what it dispatches into is the part to see.

→ SVG animVal released without detaching its owner back-pointer WebCore SVG property modelUAF

Security · High

One field of the request was checked. The ones carrying authority were not.

From a compromised renderer, the network process would fetch file:///private/etc/hosts and hand the bytes back. The cookie half of this reads worse.

→ LoadImageForDecoding accepted arbitrary schemes and spoofed first parties WebKit NetworkProcess IPC surfaceAuthBypass

Security · Medium

The complex text path never learned the rule the simple path follows.

A cached shaped run holds its fonts weakly, so someone must keep them alive; only one of the two shaping paths does. A page schedules the purge and the repaint.

→ Complex text path did not retain the system fallbacks it used WebCore font renderingUAF

Security fixes

LoadImageForDecoding MESSAGE_CHECK tripped on legitimate embedder calls
Low WebKit NetworkingAuthBypass

Other security-relevant changes

[WebKit Networking] (hardening) cf2d405 — Hardens validation in loadImageForDecoding by sourcing firstPartyForCookies from authoritative mainFrameURL instead of client-controlled state, preventing network process crashes when called before navigation or with invalid mainDocumentURL.
[Websites / PrettyPatch] (hardening) dcb203f — Added base85 decoder and 50MB size limit to PrettyPatch for handling git binary image diffs; hardens patch display on bugs.webkit.org tooling.