This Week in WebKit — August 08 - August 14, 2026

A compromised renderer can name another origin's private filesystem and read, overwrite or delete it. The check already existed — just not on the messages that needed it.

From a compromised renderer, a victim site's cached responses are readable — and writable. The write direction is the one that survives the reload.

Ordinary script drives both the free and the read inside a single DOM mutation. The odd part is what the page has to feed the table first.

Cross-origin pixels leave the canvas as a video frame and come back readable. No race, no corruption, no user gesture — just a second way out.

A datalist dropdown button keeps calling into an owner a click handler can retire. Its two sibling shadow elements already had the guard — this one never got it.