kmonsen
WebCore security specialist
Summary
kmonsen works primarily in WebCore and the WebKit process layer, and the commit stream is dominated by crashes reachable from malformed cross-process input: null URLs and schemes in blob-registry and CORS-scheme IPC, unvalidated enum decoding in WebProcessPool messages, overlong WebRTC hostnames, and non-finite geometry reaching CALayer in the GPU process. A second cluster covers layout and rendering edge cases — anchor positioning resolving against a `<br>`, sticky positioning under `-webkit-box-reflect`, `::picker-icon` attached to a non-renderer target, `getEnclosureList()` over a `display:contents` `<g>` — mostly assertion failures and null-deref rather than memory corruption, with the security-tagged work leaning toward lifetime and iterator-invalidation issues (WeakHashSet iteration, destroyed-object checks, DeferredPromise double-consuming a pending exception). Systematic-variant candidate: the `CoreIPC*` conversion helpers. `CoreIPCSecTrust::createSecTrust()` inserting nil into an `NSMutableDictionary` for empty `CoreIPCData` and `CoreIPCCGColorSpace::toCF()` dereferencing a null `Box<>` are the same bug class on different types, so the remaining CoreIPC converters are worth sweeping for empty/null payload handling from a compromised WebContent process.
Components
Security Fix History
- 2026-08-21 SpeechSynthesis::stop() must not synchronously dispatch error events; fix crash when platform cancel() calls back synchr 2026-W33
- 2026-08-05 WebAuthenticatorCoordinatorProxy signal methods must invoke reply CompletionHandler on the main run loop 2026-W31
- 2026-06-16 Check for destroyed ·
- 2026-05-03 Fix ASAN crash in CSSVariableData 2026-W18
- 2026-04-28 Use WeakHashSet::forEach to iterate over set where the iterator might be invalidated
- 2026-04-24 Disable remote display list rendering mode
- 2026-04-17 Upgrade vector.grow() assert to release assert
Hardening Commits
- 2026-09-14 Null scheme in RegisterURLSchemesAsCORSEnabled IPC crashes the Networking process
- 2026-09-13 [Writing Tools] A final text animation with no unanimated range crashes the UI process
- 2026-09-09 Validate WebCore::ActivityStateForCPUSampling when decoding WebProcessPool::ReportWebContentCPUTime
- 2026-05-20 NetworkConnectionToWebProcess::createSocketChannel should reject requests with an invalid URL
- 2026-04-17 Upgrade vector.grow() assert to release assert
Recent Commits
- 2026-09-15 [GPU Process] Non-finite bounds in UpdateSampleBufferDisplayLayerBoundsAndPosition raise CALayerInvalidGeometry and term
- 2026-09-14 Null scheme in RegisterURLSchemesAsCORSEnabled IPC crashes the Networking process
- 2026-09-13 [Writing Tools] A final text animation with no unanimated range crashes the UI process
- 2026-09-13 RenderTreeBuilder::FormControls::updatePseudoElement attaches a ::picker-icon renderer to a RenderTableCol
- 2026-09-10 [IPC] Blob registry messages carrying a null URL crash the network process
- 2026-09-09 Validate WebCore::ActivityStateForCPUSampling when decoding WebProcessPool::ReportWebContentCPUTime
- 2026-09-09 CoreIPCSecTrust::createSecTrust() inserts nil into an NSMutableDictionary for an empty CoreIPCData
- 2026-09-09 ASSERTION FAILED: layer.renderer().isStickilyPositioned() with -webkit-box-reflect on a position:sticky element
- 2026-09-06 Anchor positioned element with position-visibility crashes when its default anchor is a <br>
- 2026-09-04 Reject WebRTC socket creation with overlong hostname to fix crash
- 2026-08-21 SpeechSynthesis::stop() must not synchronously dispatch error events; fix crash when platform cancel() calls back synchr 2026-W33
- 2026-08-08 [GFC] Convert percentages in grid-auto-rows/grid-auto-columns to auto when computing intrinsic grid container size
- 2026-08-08 Fix crash from double-consuming the pending exception in DeferredPromise::reject() during Navigation reload()/navigate()
- 2026-08-05 Crash in WidthIterator::applyTextSpacingTrimIfNeeded when a character has no glyph in any font
- 2026-08-05 WebAuthenticatorCoordinatorProxy signal methods must invoke reply CompletionHandler on the main run loop 2026-W31