◆ WebKit WeeklyBeta

jernoble

WebCore security specialist

141 commits (11mo)
7 security fixes
View all commits on GitHub ↗

Summary

Works almost entirely on the media stack — HTML media elements, fullscreen/PiP, EME and MSE, text tracks and WebVTT, AirPlay session handling — with most of the code landing in WebCore and the Cocoa platform layer that wraps AVFoundation. The pattern is regression repair plus a sustained push of spec-conformance tests across Fullscreen, MediaCapture, and TextTrack, so newly covered spec corners tend to appear here first; the small security cluster is media-parsing and lifetime bugs rather than memory-safety hardening (a MIMETypeCache data race, negative timeScale/duration in sample boxes, and content sniffed as video/mp2t being loadable as HTML). Systematic-variant candidate: the sample-box validation and MSE buffer-eviction paths (TrackBuffer::removeCodedFrames crashed here recently) are where malformed-container assumptions keep surfacing, and MIME/codec-string handling has produced both a race and a type-confusion in the same window.

Components

WebCore
44%
Platform
20%
WebKit
13%
Platform Cocoa
10%
JSC
6%
WTF
4%

Security Fix History

Hardening Commits

Recent Commits

1 / 10

← All Contributors