fred-wang
WebCore security specialist
Summary
Primarily WebCore, spanning DOM/bindings plumbing (CSP host-source parsing, nonce handling for MathML, the HTMLOrForeignElement → HTMLOrSVGOrMathMLElement rename), fetch/compression-dictionary and WPT test imports, and site-isolation TestExpectations cleanup. The security fixes cluster in JS-binding and event-dispatch lifetime paths — ASAN_SEGV reports in `JSCallbackData::invokeCallback` via a WebCodecs error callback, `firstDOMWindow`/document-prototype access, and `EventTarget::fireEventListeners` — alongside a null/lifetime crash in `shapeDependentStrokeContains()` reached from `isPointInStroke()`; the same period includes checked-pointer scope reductions in `Document::updateLayout` and `processContentsBetweenOffsets`. Systematic-variant candidate: other IDL callback invocations that re-enter JS after the originating context may have been detached, following the WebCodecs `JSCallbackData` pattern.
Components
Security Fix History
- 2026-04-17 [WebKit][Main+SU] [fdae418b9cd3d6ba] WK_SEC | WebCore::EventTarget::fireEventListeners; WebCore::LocalDOMWindow::dispatc 2026-W15
- 2026-04-17 Crash in shapeDependentStrokeContains() via isPointInStroke() 2026-W15
- 2026-04-17 [WebKit][Main+SU?] [a3b9e8b1b7c6c7b7] ASAN_SEGV | WebCore::firstDOMWindow; WebCore::jsDocumentPrototypeFunction_write; A 2026-W15
- 2026-03-04 ASAN_SEGV | WebCore::JSCallbackData::invokeCallback; WebCore::JSWebCodecsErrorCallback::invoke; WebCore::WebCodecsVideoD
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-08-05 CSP host-source *:*/path does not work
- 2026-08-04 Sync WPT tests for content-security-policy/
- 2026-08-03 Sync WPT tests for preload/
- 2026-07-29 [regression] Storage::traverse(const String& type, const String& partition, ...) is broken
- 2026-07-28 Update fetch/compression-dictionary from WPT
- 2026-05-12 Implement nonce-hiding for MathML elements
- 2026-05-05 Rename HTMLOrForeignElement to HTMLOrSVGOrMathMLElement
- 2026-04-28 Use HTTP status codes in more places
- 2026-04-17 [WebKit][Main+SU] [fdae418b9cd3d6ba] WK_SEC | WebCore::EventTarget::fireEventListeners; WebCore::LocalDOMWindow::dispatc 2026-W15
- 2026-04-17 Crash in shapeDependentStrokeContains() via isPointInStroke() 2026-W15
- 2026-04-17 [WebKit][Main+SU?] [a3b9e8b1b7c6c7b7] ASAN_SEGV | WebCore::firstDOMWindow; WebCore::jsDocumentPrototypeFunction_write; A 2026-W15
- 2026-04-14 Import WPT tests for compression dictionary transport
- 2026-03-30 Update fredw's family name in WebKit contributors.json
- 2026-03-04 ASAN_SEGV | WebCore::JSCallbackData::invokeCallback; WebCore::JSWebCodecsErrorCallback::invoke; WebCore::WebCodecsVideoD
- 2026-02-09 processContentsBetweenOffsets: reduce scope of checked pointer