◆ WebKit WeeklyBeta

kkinnunen-apple

WebGPU security specialist

127 commits (10mo)
12 security fixes
View all commits on GitHub ↗

Summary

Works almost exclusively on the graphics stack — WebGL, ANGLE (including the Metal backend), and the surrounding GPU-process plumbing — mixed with routine ANGLE rolls and WebGL/dEQP conformance test updates. The security fixes are not scattered: they concentrate in ANGLE's validation layer and WebGL state tracking, covering index-range integer overflow bypassing vertex index validation, `drawElements` mishandling of large `UNSIGNED_INT` indexes, `ResumeTransformFeedback` failing to check the active program, a dangling `mOcclusionQuery` pointer on allocation failure, and an uninitialized FastMalloc heap disclosure in `RemoteGraphicsContextGL::readPixelsInline`. Systematic-variant candidate: the recurring theme is GL state that can be desynchronized or under-validated across the IPC boundary — `PACK_*` state mutable via `pixelStorei`, framebuffer deletion altering the read binding, mismatched `DrawElements` variants, PBO reads with an offset. Neighboring entry points that take client-supplied indices, offsets, or pixel-store state and are re-validated in the GPU process are the natural sweep.

Components

WebGPU
45%
Platform
21%
WebCore
17%
Other
11%
WebKit
5%
WTF
1%

Security Fix History

1 / 2

Hardening Commits

Recent Commits

1 / 9

← All Contributors