Reports

A WebGL2 page could get the GPU process to paint stale heap where its frame belonged.; A compromised renderer could put any site's name on the system credential chooser.; Feed WebCodecs a 10-bit frame and its encoder ships uninitialized heap as video.

Constant folding deleted the one check the rest of the compile had already spent; A number crossed the IPC boundary and came back out as a pointer; The filter ran first, then the worklist quietly put the candidates back

A prior fix taught one `End` handler to widen. The parser has two.; DFG liveness is a union over CFG successors. A catch handler isn't one.; A cross-instance tail call installs the callee's bounds limit, then overwrites it.

Omit one argument and the promise-pair bindings hand you an exception cell.; A buffer you can free between assigning it and pressing play.; A compromised renderer names a file it can't read, and Safari hands it back.

Closing a page freed the <html> element out from under its own shadow trees.; A scope guard that pinned the string cell but not the bytes you were reading; Streams' pipeTo checked for a fake promise with a cast that never fails

The CORS policy took a detour through the process it was written to contain.; The eval cache kept a raw pointer that nothing was keeping alive.; The array that came back from an OSR exit disagreed with itself about its layout.

B3 was right that the value was dead — the collector agreed, and freed it.; The DFG certified a property absent from an object that owned it outright.; An IC exit undid a stack adjustment that had never happened.