charliewolfe

WebCore security specialist

146 commits (7mo)

15 security fixes

Summary

Primarily works the WebKit networking process and its WebCore-side privacy surfaces — cookies, CSP, ITP/Resource Load Statistics, storage access — with a secondary line in Site Isolation and frame/process plumbing. The security fixes cluster tightly on IPC entry points into the network process: scheme and cookie-access validation on `LoadImageForDecoding`, message validation for ITP and storage-access calls, removal of a trusted `treatAsSameOriginNavigation` field from `NavigationActionData`, and narrowing a blanket storage-root path allowance in blob access enforcement — i.e. a web-process-supplied argument being trusted by the network process. Systematic-variant candidate: the remaining `NetworkConnectionToWebProcess` message handlers, checked for the same pattern of unvalidated origin, scheme, or file-path parameters crossing from the web process.

Components

WebCore

43%

WebKit

35%

Platform

13%

Site Isolation

WebGPU

Other

Security Fix History

2026-07-07 com.apple.WebKit.Networking at Received an invalid message 'NetworkConnectionToWebProcess_LoadImageForDecoding' ·
2026-07-07 Add scheme and cookie access validation to LoadImageForDecoding 2026-W27
2026-07-02 Remove blanket storage-root file path allow from blob access enforcement ·
2026-07-01 Remove treatAsSameOriginNavigation from NavigationActionData IPC ·
2026-06-30 Validate several ITP and storage access IPC messages ·
2026-06-30 Reject requestStorageAccess() without gesture should not synthesize user activation ·
2026-06-16 GetPasteboardPathnamesForType IPC allows types-only pasteboard access to read file paths ·
2026-06-12 REGRESSION(305199@main): Crash in `SourceBufferPrivate::removeCodedFramesInternal` ·
2026-06-10 Undefined left-shift in AV1 readULEBSize() ·
2026-06-10 TrackPrivateBase::removeClient has an inverted bounds check ·
2026-06-02 Initiator-omitted samesite classification can lead to SameSite=Strict cookie cross-site leakage 2026-W22
2026-05-29 Don't log interaction from temporary gesture on storage access rejection 2026-W21
2026-05-22 Content extensions should block plugin loads from embed and object elements 2026-W20
2026-05-21 Block third-party cookies for requests from about:blank popups 2026-W20
2026-04-28 Fix CSP bypass in sandboxed srcdoc iframes 2026-W17

1 / 2

Hardening Commits

No hardening commits recorded

Recent Commits

2026-08-07 Plug-in byte-range requests are blocked by connect-src instead of being governed by object-src
2026-08-06 [macOS iOS DEBUG]REGRESSION(317335@main): ipc/loadping-firstpartyforcookies-message-check.html (layout-tests) is a const
2026-07-31 REGRESSION(288096@main): ITP may cap the expiry of cookies set by a top-level navigation's own response
2026-07-30 [css-inline] Preserve fractional central baselines for atomic inlines
2026-07-28 [Cookie Store] Preserve cookie change subscription list order
2026-07-28 Make `BackForwardGoToItem` asynchronous
2026-07-26 [Site Isolation] REGRESSION(315872@main): Event coordinates are offset by the scroll position in isolated iframes
2026-07-23 Expose navigator.globalPrivacyControl only when enabled through the WKWebpagePreferences API
2026-07-23 Show process ID label alongside frame process border indicators
2026-07-23 Text translated from an RTL language keeps RTL selection behavior
2026-07-17 Remove `DidReceiveEventIPC`
2026-07-16 Revert 315959@main
2026-07-13 isQuarantinedAndNotUserApproved() should use the parsed file URL instead of re-parsing the path
2026-07-07 com.apple.WebKit.Networking at Received an invalid message 'NetworkConnectionToWebProcess_LoadImageForDecoding' ·
2026-07-07 Add scheme and cookie access validation to LoadImageForDecoding 2026-W27
2026-07-06 Suppress duplicate CSP reports for speculative preloads
2026-07-03 Gate script tracking privacy network request blocking on Resource Load Statistics
2026-07-02 Simplify script tracking privacy network request blocking
2026-07-02 Remove blanket storage-root file path allow from blob access enforcement ·
2026-07-01 RTCPacketOptions::serializableData has the SRTP auth key ternary branches swapped
2026-07-01 Remove treatAsSameOriginNavigation from NavigationActionData IPC ·
2026-06-30 Validate several ITP and storage access IPC messages ·
2026-06-30 Reject requestStorageAccess() without gesture should not synthesize user activation ·
2026-06-25 CoreIPCNSURLCredential::toID inserts the attributes dictionary as its own value
2026-06-24 CoreIPCNSURLCredential attribute type guard is always true
2026-06-24 Report correct columnNumber for blocked inline scripts
2026-06-24 WebProcessProxy::waitForSharedPreferencesForWebProcessToSync ignores the requested version for the GPU process
2026-06-23 CoreIPCNSURLRequest decodes the attribution enum from the wrong NSNumber
2026-06-23 writeToDisk dereferences a disengaged std::optional when a disk write fails
2026-06-23 UserScript::debugDescription mishandles the substring length for the sourceURL prefix
2026-06-23 LogStream::create fails to call its completion handler when StreamServerConnection creation fails
2026-06-23 Inherited policy should not re-apply a meta-delivered sandbox directive
2026-06-23 REGRESSION(309131@main): Null dereference in `WebPageProxy::useGPUProcessForDOMRenderingEnabled()`
2026-06-23 PlaceholderModelPlayer::setPlaybackRate()/setPaused() do not call their completion handler on early return
2026-06-22 CoreIPCNSURLCredential encodes flags by iterating the attributes dictionary
2026-06-19 SecureCoding::applyProcessCreationParameters dereferences a null unique_ptr
2026-06-19 Underflow in truncateByWordCount when the word limit is zero
2026-06-19 AuthenticationExtensionsClientOutputs::fromCBOR() compares a nested-map iterator against the outer map's end()
2026-06-18 HTTP cache should store responses with explicit freshness regardless of status code
2026-06-18 Update arbitrary Content-* headers from 304 responses
2026-06-18 Treat invalid Expires headers as already expired
2026-06-18 Honor Cache-Control request max-age, min-fresh and no-store
2026-06-18 Honor Cache-Control: public on unknown statuses
2026-06-18 Memory leak in `WebContextMenuItem::create()`
2026-06-18 Potential null dereference in `WebExtensionLocalization::stringByReplacingNamedPlaceholdersInString`
2026-06-18 Use-after-move in `WebExtensionRegisteredScriptsSQLiteStore::updateScripts`
2026-06-18 Add Global Privacy Control support to WebPage.NavigationPreferences Swift API
2026-06-18 Promote Global Privacy Control SPI to API
2026-06-17 Fix the build after 315399@main
2026-06-17 LocalFrameView::setViewExposedRect inverts its rect-existence-changed check
2026-06-17 pictureInPictureElement getter inverts the shadow-host connectivity check
2026-06-17 MediaMetadata artwork "sizes" parsing reads the wrong substring for height
2026-06-17 isValidVideoFrameBufferInit() tests displayWidth/Height presence against itself
2026-06-17 IIRProcessor normalization coefficient is narrowed to float
2026-06-17 adjustRegionAfterViewportSizeChange shifts rects along X for a viewport height change
2026-06-17 WebCodecsAudioEncoder logs an allocation error on the success path
2026-06-17 RemoteAudioDestinationProxy::startRenderingThread is off by one when the frame counter wraps
2026-06-17 Remove redundant validation in WebCodecs VideoFrame buffer construction
2026-06-17 WebGamepadProvider::setInitialGamepads stops at the first empty slot instead of skipping it
2026-06-17 WebResourceLoadObserver::logSubresourceLoading dereferences frame in an ASSERT placed before its null check
2026-06-16 GPURenderBundleEncoder::finish() throws an unrelated error message
2026-06-16 Download Media context-menu item checks the image URL instead of the media URL
2026-06-16 MediaSource text-track removal loop always processes the last track
2026-06-16 WorkerStorageConnection::scopeClosed() leaves getEstimate() completion handlers uncalled
2026-06-16 PDFPluginChoiceAnnotation compares NSString choices by pointer instead of value
2026-06-16 URL Pattern tokenizer emits a spurious zero-length Regexp token for empty regexp groups
2026-06-16 decompose4() computes the wrong quaternion y component
2026-06-16 WebGeolocationManager::resetPermissions has an inverted iterator check
2026-06-16 fromBacking() maps WGPUTextureFormat_RGBA16Unorm to Rgba16snorm
2026-06-16 GetPasteboardPathnamesForType IPC allows types-only pasteboard access to read file paths ·
2026-06-15 Remove stray bracket in `parseDetailsStringFromKey`
2026-06-13 UniqueIDBDatabase::createIndexAsync() is missing an early return on the null-manager path
2026-06-13 Possible null dereference in `CredentialsContainer::preventSilentAccess`
2026-06-12 encodeAsCBOR() emplaces the versions array twice and reads it after move
2026-06-12 AuthenticatorAssertionResponse::m_synchronizable is left uninitialized
2026-06-12 Fix typo in IDBIndex getAll* exception messages
2026-06-12 REGRESSION(305199@main): Crash in `SourceBufferPrivate::removeCodedFramesInternal` ·
2026-06-11 FormSubmission::create chooses the form-data encoding from the original method instead of the effective one
2026-06-11 TextResourceDecoder's find() skips the last candidate
2026-06-10 WebFrameProxy::nextSibling/previousSibling compare find() against the wrong container's end()
2026-06-10 Resolve stray `if` in loadSubframe
2026-06-10 Undefined left-shift in AV1 readULEBSize() ·
2026-06-10 TrackPrivateBase::removeClient has an inverted bounds check ·
2026-06-10 ImageOrientation::Orientation TextStream operator swaps top/bottom for all non-default orientations
2026-06-10 GraphicsContextState::mergeAllChanges records the wrong change flags for ImageInterpolationQuality and TextDrawingMode
2026-06-10 Null deref in Image::toShareableBitmap when ShareableBitmap::create() fails
2026-06-10 SourceBufferPrivate::validateInitializationSegment iterates videoTracks in the text-track branch
2026-06-10 Possible null-deref in NetworkProcess::deleteWebsiteDataForOrigin with ephemeral session
2026-06-10 GraphicsLayerAnimation TextStream dump iterationCount under "delay"
2026-06-10 createVPCodecParametersString zero-pads bitDepth based on transferCharacteristics
2026-06-10 Possible null-deref in checkRedirection completion
2026-06-10 ColorSpace::XYZ_D65 is logged as "XYZ-D50" in the TextStream operator
2026-06-10 TransformOperation TextStream uses "scaleX" for ScaleZ
2026-06-10 [Site Isolation] Avoid re-searching the document when selecting a find-in-page match
2026-06-08 Remove many unused member variables
2026-06-04 Add WKWebpagePreferences SPI to enable Global Privacy Control per-navigation
2026-06-02 Fix the internal build after 314341@main
2026-06-02 Initiator-omitted samesite classification can lead to SameSite=Strict cookie cross-site leakage 2026-W22
2026-05-29 Don't log interaction from temporary gesture on storage access rejection 2026-W21
2026-05-28 Fix inverted SPI auditing gate for `OVERRIDE_SUPPORTS_TEXT_BASED_API`
2026-05-27 [Site Isolation] `http/tests/storageAccess/request-and-grant-access-with-per-page-scope-access-from-another-frame.https.
2026-05-22 Content extensions should block plugin loads from embed and object elements 2026-W20
2026-05-21 Block third-party cookies for requests from about:blank popups 2026-W20
2026-05-13 [Site Isolation] `ResourceLoadStatistics.BackForwardPerPageData` fails
2026-05-13 [Site Isolation] `fast/frames/iframe-option-crash.xhtml` fails
2026-05-12 TestWebKitAPI.ScriptTrackingPrivacyTests.SyncXHRBlocked is a constant failure
2026-05-12 [Site Isolation] `imported/w3c/web-platform-tests/storage-access-api/requestStorageAccess-web-socket.sub.https.window.ht
2026-05-11 Add WebKitAdditions CMake include path support for Mac
2026-05-08 `imported/w3c/web-platform-tests/storage-access-api/requestStorageAccess-insecure.sub.window.html` is a flaky failure
2026-05-08 imported/w3c/web-platform-tests/storage-access-api/storage-access-permission.sub.https.window.html is flaky failure
2026-04-28 Fix CSP bypass in sandboxed srcdoc iframes 2026-W17
2026-04-22 [CMake] Use -warnings-as-errors instead of -Werror in Swift builds
2026-04-21 Compile Cocoa API tests in the CMake build
2026-04-20 [CMake] Add TestIPC and TestWGSL targets
2026-04-17 REGRESSION (309147@main): Table on a ESPNCricInfo page disappears and re-appears
2026-04-16 [CMake] TestWebKit should output a binary named TestWebKitAPI
2026-04-07 Some main frame and same-site loads are blocked with `scriptTrackingPrivacyNetworkRequestBlockingLatchEnabled`
2026-04-01 Fix the build after 310378@main
2026-03-12 REGRESSION(297346@main): Cookie dialog on hillsprofeeding.com is misplaced
2026-03-10 Crash in `Messages::WebExtensionContext::MenusRemove` completion after background page reload
2026-02-25 Crash during `ScrollerMac` destruction
2026-02-25 Crash in `WebPageProxy::viewWillStartLiveResize`
2026-02-25 Crash in `SpeechRecognitionServer::sendUpdate`
2026-02-24 WebContent process termination caused by invalid `NetworkConnectionToWebProcess_LoadImageForDecoding` message
2026-02-24 TestWebKitAPI.ResourceLoadStatistics.MigrateDataFromIncorrectCreateTableSchema is a flaky timeout
2026-02-24 [ macOS ] TestWebKitAPI.ResourceLoadStatistics.GrandfatherCallback is a flaky timeout (failure in EWS)
2026-02-23 REGRESSION(307595@main): [macOS iOS] TestWebKitAPI.WebpagePreferences.ContentRuleListEnablement is a constant failure
2026-02-23 [ macOS Release arm64 ] 2 TestWebKitAPI.PrivateClickMeasurement test are flaky timeouts
2026-02-18 REGRESSION(307595@main): [macOS iOS] TestWebKitAPI.WebpagePreferences.ContentRuleListEnablement is a constant failure
2026-02-15 Enable `ScriptTrackingPrivacyNetworkRequestBlockingEnabled`
2026-02-15 Restrict script-based network request blocking to certain tainted scripts
2026-02-13 Unconditionally block requests going to certain domains
2026-02-06 Block JS initiated mainframe navigations while safe browsing warning is displayed
2026-02-05 Delay showing modal alerts until Safe Browsing response
2026-01-29 REGRESSION (288409@main) - tv.apple.com: Unexpected to see sign-in prompt using the forward button
2026-01-28 Add tests verifying tainted script URL attribution works for setTimeout and appended inline scripts
2026-01-22 Fix `TEST(ScriptTrackingPrivacyTests, ScriptAccessCategories)`
2026-01-21 Block fetch and XHR requests coming from tainted scripts
2026-01-16 Use RELEASE_LOG_FAULT_WITH_PAYLOAD for invalid IPC message logging
2026-01-15 Crash in `PendingDownload::willSendRedirectedRequest`
2026-01-15 Crash in `WebExtensionContext::loadDeclarativeNetRequestRules`
2026-01-14 Crash in `computePageRectsWithPageSizeInternal`
2026-01-14 Crash in `RequestStorageAccess` completion handler
2026-01-14 Crash in `Geolocation::stopUpdating`
2026-01-06 [ macOS, iOS Release ] http/tests/security/clipboard/copy-paste-html-cross-origin-iframe-across-origin.html is a flaky t
2026-01-06 [macOS Release] TestWebKitAPI.ServiceWorker.ServiceWorkerWindowClientFocus is flaky failure

1 / 10

← All Contributors