anttijk
WebCore security specialist
Summary
anttijk works almost entirely in WebCore's CSS and style-resolution layer, with recent output concentrated on newly landed spec surface — css-values-5 (`calc-size()`, `attr()`, `ident()`, `random()`) and css-mixins-1 custom functions — plus invalidation and repaint paths for `::selection` and `::highlight()`. Security fixes are a small share of the work but cluster tightly around style-resolution lifetime and threading: a use-after-free in `Style::TreeResolver` reached via `XMLDocumentParser::startElementNs`, a use-after-free in `ImageLoader`'s pending load/error event dispatch, and unsynchronized access to a process-global `serializedPrimitiveValues()` HashMap, alongside re-entrancy assertions added to RuleSet building. Systematic-variant candidate: the fresh css-values-5 / css-mixins-1 parsing and substitution code, where the same author is still adjusting the invalidation and taint model (`attr()` taint through `if()`, custom-property names in the `random()` caching key) — and re-entrant style resolution generally, which the added asserts flag as a known-fragile path rather than a settled one.
Components
Security Fix History
- 2026-08-25 [WebCore] Unsynchronized access to process-global serializedPrimitiveValues() HashMap in CSSPrimitiveValue::customCSSTex ·
- 2026-08-24 [WebCore] Use-after-free in ImageLoader::dispatchPendingLoadEvent / dispatchPendingErrorEvent ·
- 2026-06-30 [WebCore] use-after-free in Style::TreeResolver — XMLDocumentParser::startElementNs missing parentNode re-check after cu ·
- 2026-03-05 [css-cascade] Implement revert-rule CSS keyword
- 2025-12-04 Stack overflow in CSSParser::consumeQualifiedRule
Hardening Commits
- 2026-08-23 ::selection fails to repaint on style change
- 2026-07-10 [css-values-5] Propagate attr()-taint through if() conditions
- 2026-06-24 Add asserts against re-entrancy during RuleSet building
- 2026-04-09 Further limit maximum render tree depth in some utility processes
- 2026-03-30 [css-values-5 attr()] <url> security
- 2026-03-25 [css-values-5 attr()] Add transitive cycle detection for attr() type() substitution
Recent Commits
- 2026-09-18 [css-values-5 calc-size()] Ignore interpolate-size in keyframes
- 2026-09-18 [css-values-5 calc-size()] Implement interpolate-size
- 2026-09-17 [css-values-5 calc-size()] Blending support
- 2026-09-17 Deeply nested block content fails to render in iOS Mail
- 2026-09-16 REGRESSION(321191@main): SaferCPP NoDeleteChecker issues in calc-size()
- 2026-09-15 [css-values-5 calc-size()] Keep unresolved size values in computed style
- 2026-09-15 [css-values-5] sibling-index() and sibling-count() are 1 for children of a shadow root
- 2026-09-10 Optimize attribute selector [class~=foo] like class selector
- 2026-09-09 [css-values-5 calc-size()] Add SizeOrKeyword<> style type base
- 2026-09-07 [css-values-5 calc-size()] Parsing and serialization
- 2026-09-04 Remove MediaQueryParserContext
- 2026-09-04 [css-values-5] Support tree counting functions in container queries
- 2026-09-03 [css-values-5] attr() stops invalidating on attribute change after a view transition
- 2026-09-02 [css-mixins-1] A typed function parameter should keep its type
- 2026-09-01 Highlight color should inherit as StyleColor