jyavenard

WebCore security specialist

234 commits (11mo)
6 security fixes
3 hardening
View all commits on GitHub ↗

Summary

jyavenard works primarily in WebCore's media stack — audio/video playback, MediaSource, encrypted-media, and the AVF-backed decoder proxies — alongside a heavy recent thread of CMake build-system work spanning the WebKit and Platform trees. The security fixes cluster tightly on object lifetime across thread and process boundaries in GPU-process media IPC: a race in RemoteImageDecoderAVFProxy, a dangling VideoFrameObserver* left behind by UserMediaCaptureManagerProxySourceProxy, and a cross-thread non-atomic ref/deref UAF on AudioParam. Systematic-variant candidate: other GPU-process media proxies that hand raw observer pointers or refcounted media objects across threads, since the same lifetime pattern produced all three bugs.

Components

WebCore
48%
WebKit
25%
Platform
21%
Other
4%
WTF
2%
JSC
0%

Security Fix History

Hardening Commits

Recent Commits

1 / 16

← All Contributors