This Week in WebKit — July 04 - July 10, 2026

A compromised renderer wraps control drawing one layer deeper, and four GPU-process threads land on the same AppKit cells. The fallback is deterministic; the interleaving isn't.

Sent twice from a compromised renderer, a create-once GPU message drops every owner of a live audio bridge. A real-time thread is still executing inside it.

Script holds the animVal long after its owner is gone, and the back-pointer never learned. The page picks the moment to dereference — what it dispatches into is the part to see.

From a compromised renderer, the network process would fetch file:///private/etc/hosts and hand the bytes back. The cookie half of this reads worse.