16 picks from 620 commits
2026-09-26 – 10-02
This Week in WebKit — September 26 - October 02, 2026
620
Total commits
9
Security fixes
6 deep-dived: 2 Medium, 4 Low; 3 triaged under Other Security-Relevant Changes
119
Contributors
Top components
WebCore · WebKit · JSC · Other · Platform
Featured
Security · Medium
A compromised renderer could take another navigation's response just by naming it.
Same network session, a sequential ID, no memory corruption needed. Even the fix's new claim queue raises a question of its own.
Security · Low
CSP blocked the style attribute, unless it was parsed somewhere with no policy.
DOMParser, template, createHTMLDocument: the staging grounds sanitizers love. Bring your own HTML-injection sink, and 'none' stops meaning none for CSS.
Development · hardening
Under Site Isolation, the UI process relayed postMessage origins it never checked.
From a compromised renderer, event.origin and event.source said whatever the sender claimed. One mismatch still only drops instead of kills, and that is deliberate.
Development · bug
An FTL optimisation handed plain JavaScript a JSValue nobody ever initialised.
Downstream code dereferences it as a cell. What that becomes depends on what the slot last held, and the trigger is ordinary JavaScript.
Development · bug
Local Network Access checked the fetches, but not the iframe pointed at localhost.
Any public page, even a non-secure one, could navigate a frame to loopback unchecked. The fix still asks the web process who initiated it.
Security fixes
- UIProcess keyEventQueue dangling reference during key-event interpretation
- GFC auto-fill repeat count has no upper clamp before allocation
- Remote snapshot recorder hard-codes DisplayList rendering mode
- TypedArray constructor length read keyed on opaque-taint bit instead of Proxy identity
Notable development
-
[Site Isolation] OffscreenCanvas transferred to a cross-site iframe never paints
feature WebKit Site Isolation / OffscreenCanvas
-
[libpas] Use tagged_bmalloc_heap for MTE allocations
refactor libpas / bmalloc allocator
-
[libpas] Support compact reservations >=128MiB
feature libpas / bmalloc allocator
-
[visionOS] Introduce Connected Volumetric Scenes
feature WebKit visionOS model element / Spatial Portal
-
[JSC] Add JSArray::fastSplice
optimization JSC Array builtins / DFG
-
Remove code guarded by !HAVE(WK_SECURE_CODING_NSURLREQUEST)
cleanup WebKit Cocoa IPC serialization
-
[JSC] Iterate Strings without allocating a JSStringIterator
optimization JSC bytecode / LLInt, Baseline, DFG
Other security-relevant changes
- [WebCore rendering / RenderEmbeddedObject]
3639421— Respects explicit zero dimensions for SVG in - [WebCore webaudio] (DoS)
2676375— Inlined frequency conversion to eliminate caller-sized Vector allocation that caused crash on Float32Arrays exceeding WTF::Vector capacity (fail-closed DoS). Also fixed unsigned truncation that rejected or silently failed large arrays. - [WebCore LBSE SVG]
9afea1e— Changed SVG viewBox transform check to consult current SMIL-animated values instead of attribute presence, fixing animated viewBox transformations on the outermost SVG element.