Reports
Weekly WebKit security reports. Filtered by InfoDisclosure.
All 23UAF 20TypeConfusion 17Race 15LogicError 15AuthBypass 15CrossOrigin 15OOB 14Other 12IntegerOverflow 11MemoryCorruption 9UninitializedMemory 7SandboxEscape 6InfoDisclosure 3
-
W35
16 picks from 462 commits 2026-08-29 – 09-04 6 security 10 dev v1.9.0
Constant folding deleted the one check the rest of the compile had already spent; A number crossed the IPC boundary and came back out as a pointer; The filter ran first, then the worklist quietly put the candidates back
OOB8Race6TypeConfusion4UAF3+6 -
W23
8 picks 2026-06-06 – 12 6 security 2 dev v1.3.3
Closing a page freed the <html> element out from under its own shadow trees.; A scope guard that pinned the string cell but not the bytes you were reading; Streams' pipeTo checked for a fake promise with a cast that never fails
UAF9OOB5Race5CrossOrigin4+13 -
W21
6 picks 2026-05-23 – 29 6 security v1.3.3
B3 was right that the value was dead — the collector agreed, and freed it.; The DFG certified a property absent from an object that owned it outright.; An IC exit undid a stack adjustment that had never happened.
UAF10OOB5AuthBypass5LogicError5+17