This Week in WebKit — August 08 - August 14, 2026
Featured
A compromised renderer can name another origin's private filesystem and read, overwrite or delete it. The check already existed — just not on the messages that needed it.
From a compromised renderer, a victim site's cached responses are readable — and writable. The write direction is the one that survives the reload.
Ordinary script drives both the free and the read inside a single DOM mutation. The odd part is what the page has to feed the table first.
Cross-origin pixels leave the canvas as a video frame and come back readable. No race, no corruption, no user gesture — just a second way out.
A datalist dropdown button keeps calling into an owner a click handler can retire. Its two sibling shadow elements already had the guard — this one never got it.
The earlier fix reads as locked at every call site and locks nothing across them. Eight workers and one clip-path are enough to reach it, reliably.
Notable development
Other security-relevant changes
- [WebCore OpenType GSUB] (integer wraparound, OOB read)
2196077— Integer wraparound in uint16_t range calculation (end + 1 wraps to 0) defeats bounds check in OpenType GSUB Coverage Format 2 parsing, causing out-of-bounds heap read from attacker-controlled font data. - [WebCore Mac controls] (race condition)
4c7a59d— Fixed a data race in GPU process where NSServicesRolloverButtonCell was shared and configured/drawn concurrently across RemoteRenderingBackend work-queue threads without synchronization. Each ControlFactory now gets a private copy. - [JSC FTL OSR exit compiler]
a02f996— Added DataFormatStorage handler to FTL OSR exit reboxAccordingToFormat, preventing RELEASE_ASSERT_NOT_REACHED crash during materialization of phantom arrays with live butterfly pointers. - [WebCore loader / NavigationRequester] (info-disclosure)
84ea03d— Fixed about:blank documents inheriting cross-origin policy containers from iframes instead of their javascript: URL initiators, enabling CSP and referrer disclosure via SecurityPolicyViolationEvent. - [WebKit WebPrivacyHelpers] (race condition, UAF)
9950c65— Fixed data race in TrackerDomainLookupInfo where resolver thread reads freed memory from concurrent rehashing by update thread. Protected with Lock and WTF_REQUIRES_LOCK annotations. - [WebCore Fullscreen API] (UI spoofing)
1ab2bb4— Disabled Fullscreen API keyboard lock by default. Incomplete UI guidance for the escape-hold-to-exit mechanism could lead to user confusion and spoofing risk.