This Week in WebKit — September 26 - October 02, 2026

620

전체 commit

Security fix

6건 심층 분석: Medium 2, Low 4 / 3건은 Other Security-Relevant Changes에서 분류

119

Contributor

Top components WebCore · WebKit · JSC · Other · Platform

Featured

Security · Medium

A compromised renderer could take another navigation's response just by naming it.

Same network session, a sequential ID, no memory corruption needed. Even the fix's new claim queue raises a question of its own.

→ NetworkProcess parked loader claimable by any WebContent process WebKit NetworkProcess resource loadingAuthBypass

Security · Low

CSP blocked the style attribute, unless it was parsed somewhere with no policy.

DOMParser, template, createHTMLDocument: the staging grounds sanitizers love. Bring your own HTML-injection sink, and 'none' stops meaning none for CSS.

→ CSP style-src-attr skipped for style attributes parsed in inert documents WebCore DOM / Content Security PolicyCrossOrigin

Development · hardening

Under Site Isolation, the UI process relayed postMessage origins it never checked.

From a compromised renderer, event.origin and event.source said whatever the sender claimed. One mismatch still only drops instead of kills, and that is deliberate.

→ [Site Isolation] Validate the target frame of cross-process postMessage and focus WebKit Site Isolation

Development · bug

An FTL optimisation handed plain JavaScript a JSValue nobody ever initialised.

Downstream code dereferences it as a cell. What that becomes depends on what the slot last held, and the trigger is ordinary JavaScript.

→ [JSC] B3 specializeSelect must not clone Phis JSC B3

Development · bug

Local Network Access checked the fetches, but not the iframe pointed at localhost.

Any public page, even a non-secure one, could navigate a frame to loopback unchecked. The fix still asks the web process who initiated it.

→ Check iframe navigations for Local Network Access against their initiator WebKit NetworkProcess Local Network Access

Security fixes

UIProcess keyEventQueue dangling reference during key-event interpretation
Medium WebKit UIProcess iOS keyboard eventsUAF
GFC auto-fill repeat count has no upper clamp before allocation
Low WebCore Layout Grid Formatting ContextOther
Remote snapshot recorder hard-codes DisplayList rendering mode
Low WebKit remote snapshottingLogicError
TypedArray constructor length read keyed on opaque-taint bit instead of Proxy identity
Low JavaScriptCore runtime TypedArray constructorsTypeConfusion

Notable development

[Site Isolation] OffscreenCanvas transferred to a cross-site iframe never paints
feature WebKit Site Isolation / OffscreenCanvas
[libpas] Use tagged_bmalloc_heap for MTE allocations
refactor libpas / bmalloc allocator
[libpas] Support compact reservations >=128MiB
feature libpas / bmalloc allocator
[visionOS] Introduce Connected Volumetric Scenes
feature WebKit visionOS model element / Spatial Portal
[JSC] Add JSArray::fastSplice
optimization JSC Array builtins / DFG
Remove code guarded by !HAVE(WK_SECURE_CODING_NSURLREQUEST)
cleanup WebKit Cocoa IPC serialization
[JSC] Iterate Strings without allocating a JSStringIterator
optimization JSC bytecode / LLInt, Baseline, DFG

Other security-relevant changes

[WebCore rendering / RenderEmbeddedObject] 3639421 — 기존에는