graouts
WebCore security specialist
Summary
graouts works almost exclusively in WebCore's animation stack — Web Animations, scroll-driven timelines, threaded/accelerated animations, and `animation-trigger` property parsing — with recent output concentrated on `timeline-scope` resolution and style-originated timeline matching. The security fixes are not scattered across that surface: they cluster in accelerated and threaded animation paths, covering a cross-thread UAF reachable in the UIProcess through an unguarded static `TinyLRUCache`, a use-after-free from `m_timelines` rehashing inside `AnimationTimelinesController::suspendAnimations`, and repeated crashes from accelerated animations that combine view-progress timeline ranges with a scroll time — with the `OrderedHashSet` adoption for `AnimationCollection` targeting the same container-mutation-during-iteration class. Systematic-variant candidate: object lifetime and iteration safety in animation state shared across the WebProcess/UIProcess boundary, plus the timeline-matching code, which is being actively rewritten rather than maintained.
Components
Security Fix History
- 2026-09-02 [threaded-animations] cross-thread UAF in UIProcess via unguarded static TinyLRUCache in AcceleratedEffect polygon path ·
- 2026-07-01 [web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash ·
- 2026-06-30 [web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash ·
- 2026-06-29 [web-animations] accelerated animation with view progress timeline range but no timeline yields a crash ·
- 2026-06-29 [web-animations] use-after-free in AnimationTimelinesController::suspendAnimations: m_timelines rehashes during iteratio ·
- 2026-06-24 [threaded-animations] webanimations/threaded-animations/fill-mode-adjustment-additive.html may crash under ASan 2026-W25
- 2026-04-08 [web-animations] setting effect to null in `CustomEffect` callback leads to a crash
Hardening Commits
Recent Commits
- 2026-09-17 [scroll-animations] reduce use of `Styleable` when managing style-originated timelines
- 2026-09-17 [threaded-animations] ensure remote timelines and animations are cleared when a web process crashes
- 2026-09-15 Update snapshot of animation-related WPT tests
- 2026-09-15 Update snapshot of animation-related WPT tests
- 2026-09-11 [scroll-animations] make `subject` a required parameter when constructing a `ViewTimeline`
- 2026-09-11 [threaded-animations] updating keyframes of an accelerated animation's effect to unresolved offsets should disable accel
- 2026-09-11 [scroll-animations] update WPT sync
- 2026-09-11 [scroll-animations] Style resolution with scroll-timeline name blocks main thread for multiple seconds
- 2026-09-07 [scroll-animations] WPT test `scroll-animations/css/animation-timeline-none.html` has a failure
- 2026-09-02 [threaded-animations] cross-thread UAF in UIProcess via unguarded static TinyLRUCache in AcceleratedEffect polygon path ·
- 2026-09-01 REGRESSION(294049@main): paused and seeked animation finishes when resumed after a rate-adjusted animation
- 2026-09-01 [scroll-animations] changed `timeline-scope` values should update timelines for animations globally
- 2026-09-01 [scroll-animations] style-originated timelines defined outside of `timeline-scope` hierarchy should yield an inactive ti
- 2026-09-01 [scroll-animations] prioritize timelines established by an ancestor over others visible thanks to `timeline-scope`
- 2026-08-31 [scroll-animations] match style-originated timelines globally