Reports
Weekly WebKit security reports. Filtered by UAF.
-
W33
15 picks from 422 commits 2026-08-15 – 21 5 security 10 dev v1.7.0
The detach that guarantees no compiled code survives missed one cache.; The APNG geometry check authorised the compositing loop, not the transform after it.; The privileged process took the sandboxed one's word for a buffer's shape.
OOB2CrossOrigin1Race1UAF1 -
W32
7 picks from 384 commits 2026-08-08 – 14 6 security 1 dev v1.3.3
Sixteen storage handlers took an integer as proof you owned the file.; Another site's cache will happily serve back what you wrote into it.; A shadow-DOM cache that outlived the table it was stored inside.
AuthBypass2CrossOrigin2Race2TypeConfusion2+5 -
W31
8 picks from 470 commits 2026-08-01 – 07 1 security 7 dev v1.3.0
Three WebAuthn replies came back on a queue WebKit didn't choose.; Two array opcodes shared one case label in JSC's write-barrier phase.; The memory64 check that only looked at the memory it was holding.
IntegerOverflow3UAF2Race1TypeConfusion1+1 -
W28
5 picks from 488 commits 2026-07-11 – 17 3 security 2 dev v1.2.0
The JIT proved a broad type and treated it as proof of the exact one.; A lock refactor let a shared object's last reference escape the lock.; The privileged process trusted the sandbox to say the user tapped.
UAF3AuthBypass1TypeConfusion1 -
W27
6 picks from 447 commits 2026-07-04 – 10 6 security v1.3.2
The per-thread isolation held at every level except the one that made levels.; Overwriting a callback was a free, and a real-time thread was inside it.; Three code paths dropped the pointer. Only the destructor remembered to detach.
UAF4AuthBypass3Other2 -
W26
8 picks from 557 commits 2026-06-27 – 07-03 6 security 2 dev v1.7.0
Omit one argument and the promise-pair bindings hand you an exception cell.; A buffer you can free between assigning it and pressing play.; A compromised renderer names a file it can't read, and Safari hands it back.
UAF40Race20AuthBypass16LogicError15+55 -
W25
6 picks from 393 commits 2026-06-20 – 26 6 security v1.3.2
The UI process asked the sandbox which site it was talking to.; Two threads, one easing curve, and a reference count that couldn't count.; A frame ID is a name, not a permission — the pasteboard disagreed.
CrossOrigin2AuthBypass1Other1UAF1+1 -
W24
7 picks from 397 commits 2026-06-13 – 19 6 security 1 dev v1.3.3
Two of four sibling access types never told the collector what they held.; The literal parser knew __proto__ could run script, and guarded the wrong thing.; The dialog handed back a return value from memory the page just freed.
UAF6Race5TypeConfusion3AuthBypass3+7 -
W23
8 picks from 484 commits 2026-06-06 – 12 6 security 2 dev v1.3.3
Closing a page freed the <html> element out from under its own shadow trees.; A scope guard that pinned the string cell but not the bytes you were reading; Streams' pipeTo checked for a fake promise with a cast that never fails
UAF9OOB5Race5CrossOrigin4+13 -
W22
9 picks from 480 commits 2026-05-30 – 06-05 6 security 3 dev v1.3.3
The CORS policy took a detour through the process it was written to contain.; The eval cache kept a raw pointer that nothing was keeping alive.; The array that came back from an OSR exit disagreed with itself about its layout.
CrossOrigin6Other5UAF4LogicError3+10 -
W21
6 picks from 423 commits 2026-05-23 – 29 6 security v1.3.3
B3 was right that the value was dead — the collector agreed, and freed it.; The DFG certified a property absent from an object that owned it outright.; An IC exit undid a stack adjustment that had never happened.
UAF10OOB5AuthBypass5LogicError5+17 -
W20
16 picks from 423 commits 2026-05-16 – 22 6 security 10 dev v1.5.0
The collector was never told where the exit stub parked its pointers; Nine arguments, six registers, and zero bytes reserved for the overflow; A private field read that answers with the prototype's value
UAF4Other3LogicError2MemoryCorruption2+6 -
W19
14 picks from 417 commits 2026-05-09 – 15 4 security 10 dev v1.7.0
The Metal validator turned an attacker-sized upload into a crash — where it runs.; A modal context menu that never stopped listening to the web process.; It shipped as a hit-rate fix, on eight cache slots of live CoreGraphics handles.
UAF3Race1 -
W18
15 picks 2026-05-02 – 08 5 security 10 dev v1.7.0
A stylesheet and one getComputedStyle() call read freed token storage.; The object-src spelling that looks like deny-all was the permissive one.; The GPU process let the renderer vote on which draft extensions it could use.
UAF2CrossOrigin1TypeConfusion1LogicError1