◆ WebKit WeeklyBeta
← All reports
16 picks from 518 commits
2026-09-19 – 25

This Week in WebKit — September 19 – September 25, 2026

312
Total commits
6
Security fixes
3 High, 1 Medium, 2 Low
96
Contributors
Top components JSC DFG/FTL & B3 · WebCore HTML canvas · WebKit NetworkProcess IPC · WebCore frame tree · WebKit WebRTC codecs · JSC WebAssembly

Featured

Security · High
Two iframes, two Set prototypes, and the compiled code watching the wrong one.

Overwriting Set.prototype[Symbol.iterator] jettisoned nothing, and the spread ran attacker JavaScript where the compiler had proven nothing could run. Two invalidation nets were dodged, not one.

→ Canvas 2D `beginLayer()` use-after-free on save-stack overflow WebCore HTML canvasUAF
Security · High
Instruction selection sank an atomic past memory.grow, onto memory already freed.

In bounds-checking mode the grow hands the old region back, and the sunk compare-and-swap still executes against it. What the fusion check asked about that CAS was never what ran in between.

→ DFG/FTL `Spread(SetObjectUse)` realm confusion in watchpoint coverage JSC DFG/FTL JITTypeConfusion
Security · High
The canvas save stack hit its cap, and the cap stopped being a resource limit.

save() declines silently at the cap, and beginLayer() took it for success. The freed drawing context is then dereferenced on every draw call — a repeatable use, not a one-shot.

→ B3 `LowerToAir` CAS miscompilation — atomic sunk past interfering effects JSC B3→Air instruction selectionMemoryCorruption
Security · Medium
A compromised renderer could borrow another WKWebView's cookie policy by name.

The page identifier arrived in the message and was never checked against the sender. A real entitlement check ran on every one of these paths — just not on that axis.

→ NetworkProcess missing IPC authorization on `WebPageProxyIdentifier` WebKit NetworkProcess IPC surfaceAuthBypass

Security fixes

Notable development

Other security-relevant changes

  • [WebCore canvas rendering] 2ce92dc — Implements HTMLCanvasElement::requestPaint() and CanvasPaintEvent dispatch via Document-level event queue and RenderingUpdateStep. New HTML-in-Canvas feature surface without visible security implications in the visible diff.
  • [WebKit NetworkProcess] (partition bypass) 397d4fb — Preserves the _allowOnlyPartitionedCookies flag across HTTP redirects to prevent unpartitioned third-party cookies from leaking in media requests when CHIPS cookie partitioning is enabled.
  • [WebKit Geolocation] (permission prompt spoofing) 3b4fe5b — Geolocation permission prompt now derives origin from the requesting frame instead of the page's active navigation URL, ensuring it displays the correct origin even when navigation to another site occurs during the request.
  • [WebKit HSTS] (hardening) 33c016a — Fixed HSTS partitioning regression: CHIPS adoption caused third parties to resolve to AllExceptPartitioned instead of All, breaking the old gate. Updated HSTS downgrade logic to gate on any blocking decision other than None, preventing third parties from querying the shared HSTS cache as a tracking vector.
  • [WTF / WebKitLegacy] (hardening) 669358d — Addressed unretained argument warnings in WebKitLegacy by adding CF type trait declarations (CFSet, CFMutableSet, CGPDFDocument) and reorganizing DDResult template specializations to improve SaferCPP memory safety analysis.
  • [git-webkit tooling] 8bb663b — Development tooling fix to git-webkit: pr --no-bug now preserves user-provided titles in commit messages instead of discarding them. No runtime or security impact.
Generated with prompt v1.10.1