◆ WebKit WeeklyBeta
← All reports
5 picks from 468 commits
2026-07-18 – 24

This Week in WebKit — July 18 - July 24, 2026

468
Total commits
4
Security fixes
High 4건
107
Contributors
Top components WebCore · WebKit · JSC · Other · Platform

Featured

Security · High
The hash check that ran before the script even existed.

Strict-dynamic hashes an inline script's known body — but what if the body is an external file that never loaded? On the right policy, HTML injection turns into same-origin script execution.

→ CSP strict-dynamic empty-hash bypass WebCore Content Security PolicyCrossOrigin
Security · High
A hot defineProperty fold kept a shape but dropped the check it was an object.

A descriptor's shape isn't proof it's an object — yet the fold emitted an unchecked load anyway. undefined gets dereferenced as a cell, and a controlled read is one merged immediate away.

→ DFG Object.defineProperty descriptor cell confusion JSC DFG JITTypeConfusion
Security · High
A recorded font stays safe on one thread — until a canvas hands it to two.

Move a display-list buffer between two GPU-process backends and both threads race the same refcount. Whoever loses drops a still-live Font — a use-after-free one step inside the graphics sandbox.

→ Cross-thread Font refcount race on display-list transfer WebKit GPU process — RemoteRenderingBackendTypeConfusion
Security · High
The RAII guard that trusted save() to always make room.

Saturate the canvas save-stack and the next save() quietly does nothing — including the one a filtered draw's scope guard counted on. That draw runs against a context it just freed.

→ Canvas2D filter switcher UAF under save-stack exhaustion WebCore HTML Canvas 2DLogicError

Notable development

Generated with prompt v1.2.0