This Week in WebKit — August 01 - August 07, 2026
Featured
Web content drives all three into the unsandboxed UI process, and the invariant they break is guarded by an assertion. Release builds don't compile it in.
One of them appends; the other shifts live cells around inside storage. That difference is a use-after-free from plain JS under GC pressure.
Declaration order alone decided whether a multi-memory module was rejected. IPInt then had to bounds-check a pairing the validator promised it would never see.
Element-segment offsets above 4 GiB landed at index 0 instead of failing instantiation, carrying attacker-chosen funcrefs. WebKit fixed this class once already, one path over.
A table64 maximum just past 2^32 narrows on the way into storage, so every consumer looks right in isolation. One of those consumers is a JIT constant.