◆ WebKit WeeklyBeta
← All reports
11 picks from 765 commits
2026-10-10 – 16

This Week in WebKit — October 10 - October 16, 2026

765
Total commits
1
Security fixes
High: 1
125
Contributors
Top components WebCore · WebKit · Other · Platform · JSC

Featured

Security · High
WebCore's media tracks wrote their own GC-thread warning, then raced past it.

Page script can race the background marker into a use-after-free on a small heap object. Crash by default; control flow needs repeated race wins and heap reclaim.

→ Media track opaque-root race on the concurrent GC thread WebCore media track bindingsRace
Development · hardening
Site isolation gave iframes their embedder as first party, and its cookies too.

A compromised cross-site iframe process could read and write its embedder's cookies, HttpOnly included. The network process did check, just not the part that mattered.

→ [Site Isolation] Authorize cookie IPC against the sites a web process hosts WebKit Site Isolation
Development · bug
In WebGPU's image upload, zero bytes per pixel meant no upper bound at all.

Image properties a page influences can push copyExternalImageToTexture into an out-of-bounds read. The trigger isn't a bad pixel; it's a format the code never expected.

→ MallocSpan crash in GPUQueue::copyExternalImageToTexture WebGPU

Notable development

Generated with prompt v1.11.0