eric-carlson
WebCore contributor
Summary
Works almost entirely on the Cocoa media stack — MediaStream/getUserMedia and ImageCapture capture paths, WebAudio session management, AVFoundation-backed playback, and the recent work routing audio-session activation and NowPlaying through a MediaSessionManagerClient for site isolation. The security fixes are not scattered: they cluster on cross-thread state in the GPU process — an off-main-thread CDM session destructor mutating unlocked LegacyCDMPrivateAVF state, a startProducingData race against audio description preparation in UserMediaCaptureManagerProxy, and a use-after-free in InternalAudioEncoderCocoa when the stream format changes mid-flight. Systematic-variant candidate: the GPUProcess capture and encoder proxies, where AVFoundation callbacks arrive on delegate queues while IPC handlers touch the same objects — the same shape recurs across ImageCapture reconfiguration, rotation handling, and encoder ASBD transitions.
Components
Security Fix History
- 2026-07-03 [CoreIPC] [GPUP] off-main-thread ~CDMSessionAVContentKeySession mutates unlocked LegacyCDMPrivateAVFObjC::m_sessions Vec ·
- 2026-07-01 [CoreIPC][GPUProcess] UserMediaCaptureManagerProxy::startProducingData races prepareAudioDescription() against audioSamp ·
- 2026-06-30 [WebCore] Use-after-free in InternalAudioEncoderCocoa on ASBD change because converter->finish() promise is discarded ·
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-07-31 [Site Isolation] Activate the audio session in the GPU process when site isolation is enabled
- 2026-07-31 [WebAudio] AudioContext leaves its media session registered after frame teardown
- 2026-07-30 ImageCapture.takePhoto() silently fails forever on a getUserMedia track after one transient -[AVCaptureSession canAddOut
- 2026-07-27 [Site Isolation] Define a MediaSessionManagerClient to route audio-session activation and NowPlaying
- 2026-07-23 [Site isolation] Re-land AudioSession asynchronous activation
- 2026-07-06 [MediaStream] OverconstrainedError does not inherit from DOMException and has no code attribute
- 2026-07-03 [CoreIPC] [GPUP] off-main-thread ~CDMSessionAVContentKeySession mutates unlocked LegacyCDMPrivateAVFObjC::m_sessions Vec ·
- 2026-07-01 [Site isolation] Make AudioSession activation asynchronous
- 2026-07-01 `configurationchange` event is dropped when MediaStream track configuration changes while track is muted
- 2026-07-01 [CoreIPC][GPUProcess] UserMediaCaptureManagerProxy::startProducingData races prepareAudioDescription() against audioSamp ·
- 2026-06-30 [WebCore] Use-after-free in InternalAudioEncoderCocoa on ASBD change because converter->finish() promise is discarded ·
- 2026-06-25 [Cocoa] Transient device rotation can result in incorrect video frame orientation
- 2026-05-29 [Cocoa] Update the current cue's endTime when legible output sends an empty or NULL attributed array
- 2026-05-15 [Cocoa] Use AVCapturePhotoOutputReadinessCoordinator when taking photo
- 2026-05-05 ASSERT under HTMLMediaElement::virtualHasPendingActivity