◆ WebKit WeeklyBeta
← All reports
12 picks from 686 commits
2026-10-03 – 09

This Week in WebKit — October 03 - October 09, 2026

686
Total commits
2
Security fixes
1 High, 1 Medium
118
Contributors
Top components WebCore · WebKit · Platform · Other · JSC

Featured

Security · High
A WebGL2 page could get the GPU process to paint stale heap where its frame belonged.

Two ordinary API calls, no privileges, a read-only leak. Whether those bytes ever reach script, and whose memory they were, is the open question.

→ WebGL paint readback returns uninitialized PixelBuffer on rejected read WebCore ANGLE WebGL backendUninitializedMemory
Security · Medium
A compromised renderer could put any site's name on the system credential chooser.

The validator was there all along; it just vouched for the wrong thing. Whether that means UI spoofing or a credential bound to a victim site depends on the chooser.

→ Digital Credentials chooser trusted renderer-supplied origins WebKit UIProcess Digital CredentialsAuthBypass
Development · bug
Feed WebCodecs a 10-bit frame and its encoder ships uninitialized heap as video.

No error, no crash, and the bitstream comes back to JavaScript. Only one caller was patched; the routine that stayed silent still does.

→ WebCodecs VPX encoder encoded uninitialized data from 10-bit frames WebCore WebCodecs
Development · bug
A compromised web process could talk its way onto the local network, no prompt shown.

The permission check was real; the facts it ruled on came from the attacker. Three different lies each skipped the prompt.

→ Local Network Access stops trusting the web process's client description WebKit NetworkProcess

Notable development

Generated with prompt v1.11.0