◆ WebKit WeeklyBeta
← All reports
15 picks from 422 commits
2026-08-15 – 21

This Week in WebKit — August 15 - August 21, 2026

422
Total commits
5
Security fixes
3 High, 2 Medium
104
Contributors
Top components WebCore · WebKit · Other · JSC · Platform

Featured

Security · High
The detach that guarantees no compiled code survives missed one cache.

A VM-lifetime cache kept an entry point for code the engine had just declared dead. Script chooses when the detach lands — the rest depends on what reclaims that memory first.

→ JSC MicrotaskCallCache retains detached CodeBlock entry points JSC runtime/interpreterUAF
Security · High
The APNG geometry check authorised the compositing loop, not the transform after it.

Two operations walk the same row and disagree about where it ends. On LCMS ports (GTK, WPE), that disagreement is a heap write whose length the image file picks.

→ PNGImageDecoder ICC transform overruns the frame buffer WebCore image decodersOOB
Security · High
The privileged process took the sandboxed one's word for a buffer's shape.

A snapshot reply hands the UI process a surface that describes its own geometry, and a compromised renderer writes that description. Read-only — but on the far side of the sandbox.

→ IOSurface from renderer send right consumed without validation WebKit UI process IPC surfaceOOB
Security · Medium
A srcdoc frame inherited its origin from one parent and its cookies from another.

Nest it one level deep inside a cross-origin iframe and SameSite=Strict stops defending the top-level site. At depth one, everything behaves perfectly.

→ Srcdoc iframes inherit the top-level site for cookies WebCore loaderCrossOrigin
Security · Medium
Teardown promised no script would run, then fired an event at a live listener.

An utterance built in one document, spoken through another frame's synthesiser, outlives the frame that stopped it. Debug builds assert; release builds just run your listener.

→ SpeechSynthesis teardown dispatches events inside a script-disallowed scope WebCore Web Speech APIRace

Notable development

Generated with prompt v1.7.0