eric-carlson
WebCore security specialist
Summary
Works almost entirely on the Cocoa media stack — MediaStream/getUserMedia and ImageCapture capture paths, WebAudio session management, AVFoundation-backed playback, and the recent work routing audio-session activation and NowPlaying through a MediaSessionManagerClient for site isolation. The security fixes are not scattered: they cluster on cross-thread state in the GPU process — an off-main-thread CDM session destructor mutating unlocked LegacyCDMPrivateAVF state, a startProducingData race against audio description preparation in UserMediaCaptureManagerProxy, and a use-after-free in InternalAudioEncoderCocoa when the stream format changes mid-flight. Systematic-variant candidate: the GPUProcess capture and encoder proxies, where AVFoundation callbacks arrive on delegate queues while IPC handlers touch the same objects — the same shape recurs across ImageCapture reconfiguration, rotation handling, and encoder ASBD transitions.
Components
Security Fix History
- 2026-09-11 Hold AudioHardwareListener client weakly and stop caching listener proxies across clients 2026-W36
- 2026-08-20 [Site Isolation] Elect the NowPlaying session in the GPU process 2026-W33
- 2026-07-03 [CoreIPC] [GPUP] off-main-thread ~CDMSessionAVContentKeySession mutates unlocked LegacyCDMPrivateAVFObjC::m_sessions Vec ·
- 2026-07-01 [CoreIPC][GPUProcess] UserMediaCaptureManagerProxy::startProducingData races prepareAudioDescription() against audioSamp · CVE-2026-43731
- 2026-06-30 [WebCore] Use-after-free in InternalAudioEncoderCocoa on ASBD change because converter->finish() promise is discarded ·
Hardening Commits
Recent Commits
- 2026-09-11 Hold AudioHardwareListener client weakly and stop caching listener proxies across clients 2026-W36
- 2026-09-10 AudioSourceProviderAVFObjC should only allow callbacks to be set once
- 2026-08-30 [Site Isolation] Deliver a received remote-control command to the same session with and without site isolation
- 2026-08-27 [Site Isolation] Cleanup TestExpectations after recent AudioSession fixes
- 2026-08-24 [Site Isolation] UI-process crash in MediaSessionManagerCocoa::audioOutputDeviceChanged() after the last media session i
- 2026-08-20 [Site Isolation] Elect the NowPlaying session in the GPU process 2026-W33
- 2026-08-12 [Site Isolation] Activate the audio session per web process
- 2026-07-31 [Site Isolation] Activate the audio session in the GPU process when site isolation is enabled
- 2026-07-31 [WebAudio] AudioContext leaves its media session registered after frame teardown
- 2026-07-30 ImageCapture.takePhoto() silently fails forever on a getUserMedia track after one transient -[AVCaptureSession canAddOut
- 2026-07-27 [Site Isolation] Define a MediaSessionManagerClient to route audio-session activation and NowPlaying
- 2026-07-23 [Site isolation] Re-land AudioSession asynchronous activation
- 2026-07-06 [MediaStream] OverconstrainedError does not inherit from DOMException and has no code attribute
- 2026-07-03 [CoreIPC] [GPUP] off-main-thread ~CDMSessionAVContentKeySession mutates unlocked LegacyCDMPrivateAVFObjC::m_sessions Vec ·
- 2026-07-01 [Site isolation] Make AudioSession activation asynchronous