bnham

WebKit contributor

58 commits (10mo)

1 security fixes

Summary

Primarily WebKit process management and site isolation plumbing — page load assertions across cross-site navigations, RunningBoard-managed XPC service lifecycle, process-state monitoring, and sync IPC timeouts — with a secondary line of work on injected content worlds and user script/style handling in extensions. The recurring theme is boundary state: which process owns a frame after a navigation or COOP-induced BCG switch, and which world a script or callback executes in, including the lone security fix restricting WebPasteboardProxy to descendant remote frames. The audit angle: the normal vs. non-normal world distinctions (`evaluateScript` exposure, mutation observer callbacks, content world clearing) are a privilege boundary between page script and extension/injected script — incomplete coverage of that split is the kind of gap that reproduces across sibling APIs.

Components

WebKit

52%

Platform

30%

WebCore

16%

WTF

Security Fix History

2026-06-22 [Site Isolation] WebPasteboardProxy should only allow access to remote frames that are descendants of the root frame bei 2026-W25

Hardening Commits

No hardening commits recorded

Recent Commits

2026-08-07 Site-isolated iframe processes keep a page load assertion after a cross-site navigation
2026-08-05 Shared/service workers don't run in same process after COOP-induced BCG switch
2026-08-03 Site-isolated iframe processes keep a page load assertion after a cross-site navigation
2026-07-13 Avoid unnecessary WebContent IPC when logging frame trees
2026-07-10 Fix _doAfterNextPresentationUpdate hanging forever in views using _relatedWebView
2026-06-26 Only use ProcessStateMonitor on processes that are managed by RunningBoard
2026-06-25 Only expose evaluateScript in non-normal worlds
2026-06-22 [Site Isolation] WebPasteboardProxy should only allow access to remote frames that are descendants of the root frame bei 2026-W25
2026-06-19 Distinguish between mutation observer callbacks in normal vs. non-normal worlds
2026-06-17 Add an API test to ensure WebContent is managed by RunningBoard
2026-06-17 Debounce screen properties changed notifications
2026-06-13 WKJSHandle keeps documents alive after navigation
2026-06-11 Fix RunningBoard not being able to manage WebKit XPC services on Mac
2026-06-10 [Site Isolation] Fix YouTube crash
2026-06-06 Debounce screen properties updates
2026-05-19 Exempt origins with push subscriptions from time-based website data eviction
2026-05-08 Reduce sync IPC timeout for RequestAcceptsFirstMouse
2026-05-08 Add ability to clear content world
2026-04-09 Add LOOA check for user script and user style interning
2026-03-27 Reduce memory overhead of user scripts and user styles in extensions with many distinct match patterns
2026-03-26 Fix empty TransferString being deserialized as null string
2026-03-25 Fix empty TransferString being deserialized as null string
2026-03-23 Reduce memory overhead of user scripts and user styles in extensions with many distinct match patterns
2026-03-13 Limit length of @counter-style padding
2026-03-10 Make lifetime activity use background assertion by default on macOS
2026-03-06 Coalesce SetScreenProperties message
2026-03-05 Fix flaky KeyboardEventTests.UserTextInputEvent test
2026-03-04 Fix flaky timeout in WKUserContentController.DidAssociateFormControlsFromShadowTree
2026-03-04 Make MobileMiniBrowser a scene-based application
2026-03-03 Add preference to disable WebBackForwardCache
2026-03-02 Allow JSBuffer to take virtual copy of read-only memory
2026-02-27 Move dataURL creation in tabsCaptureVisibleTab to background thread
2026-02-26 STP webpushd-relocatable links the wrong WebKit
2026-02-26 Log if ParentalControlsContentFilter blocks for a long time
2026-02-25 Extend JS source string copy optimizations to more content worlds
2026-02-13 STP webpushd should not reuse system webpushd launchd label
2026-02-12 Make UsesBackForwardCache defaults overridable
2026-02-11 GetPushSubscription should throw AbortError on webpushd connection error
2026-01-30 Add defaultLanguage to list of preheated functions
2026-01-22 Dirty encoded image blobs are not replaced by clean encoded image blobs as expected
2026-01-22 Initialize CacheModel based on whether app is a web browser
2026-01-21 Enable main resource blob cache
2026-01-21 Reduce fragmentation of small uncached network resources
2026-01-07 Add memory cache for recently loaded top resources in NetworkProcess
2025-12-19 Reduce number of memory copies needed to evaluate long JS strings
2025-12-19 Use more efficient network traffic attribution API
2025-12-18 Use more efficient network traffic attribution API
2025-12-12 Reduce number of memory copies needed to evaluate long JS strings
2025-12-08 Fix linked-on-or-after check for using process assertions off the main thread
2025-12-01 Add a composed submit event
2025-12-01 Add webkitTrustedOnly event listener option
2025-12-01 Add an event that fires for user text input
2025-11-19 Fix linked-on-or-after check for using process assertions off the main thread
2025-11-09 Emit signposts for evaluateJavaScript
2025-11-07 Make PLT debounce interval configurable
2025-11-06 Fix resource IDs in networking logs
2025-11-04 Work around CF timers not being serviced promptly
2025-10-31 Assert when ProcessThrottler is used off of the main thread

1 / 4

← All Contributors