amarchenko
WebCore contributor
Summary
Works almost exclusively on the `<model>` element and ModelProcess pipeline — GLTF/GLB-to-USDZ conversion, ModelPlayer lifecycle, process entitlements, and the WebContent↔ModelProcess IPC surface, largely driven by visionOS spatial rendering. The security-relevant commits sit squarely on that boundary: an ASSERT-instead-of-MESSAGE_CHECK on a client-supplied ModelPlayer identifier (a release-build IPC validation gap) and a UAF in image-based-lighting memory attribution, alongside ongoing work making ModelPlayer node-addressable and moving model conversion off the main thread. The audit angle: ModelProcess is a comparatively young process with an expanding IPC surface and untrusted asset parsing, and identifier-keyed player creation plus the new multi-model/child-portal message handlers are the natural place to sweep for sibling validation and lifetime bugs.
Components
Security Fix History
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-09-16 Add CSS syntax for position-context
- 2026-09-16 Add environment-map CSS property
- 2026-09-04 Add position-anchor syntax for model attachment points
- 2026-08-21 Support per-child entity transforms for <model> inside a spatial portal
- 2026-08-12 Implement child model lifecycle for spatial portals
- 2026-08-02 Implement child model loading IPC for spatial portals
- 2026-07-30 REGRESSION(318004@main): All ModelProcess LayoutTests are failing in Debug
- 2026-07-29 Make ModelPlayer node-addressable for Multi-Model
- 2026-07-27 Add log messaging relay to the Model Process
- 2026-07-16 rdar://181856284 ([REGRESSION] Model Process logging is broken on visionOS - logd denied with no forwarding fallback)
- 2026-07-03 Model does not change current src based on the media attribute
- 2026-07-02 Upstream HAVE_MODEL_MEMORY_ATTRIBUTION feature flag
- 2026-06-30 Convert models off the main thread in the model process
- 2026-05-29 CreateModelPlayer Uses ASSERT Instead of MESSAGE_CHECK for Duplicate Identifier ·
- 2026-04-22 [visionOS] Support negative playbackRate in <model>