mwyrzykowski
WebKit security specialist
Summary
Primarily WebGPU and the GPU process, with secondary work on WebKit platform plumbing, TileController, and HTMLModelElement/inline model rendering. The security fixes cluster almost entirely in WebGPU validation and state-tracking paths — uint32 wraparound in index clamping, buffer map-count confusion via `getMappedRange`, a bind group validation-cache key collision leading to OOB write, and an `importExternalTexture` origin-clean bypass — with the hardening work all on concurrent `HashMap` access surfaced by MTE. Systematic-variant candidate: the WebGPU validation cache and buffer/texture state machine, where several distinct memory-safety classes landed within days of each other.
Components
WebKit
36%
WebGPU
27%
WebCore
19%
Platform
17%
WTF
1%
Other
1%
Security Fix History
- 2026-07-01 uint32 Wraparound in vsUintIndexClamp Leads to GPU OOB Read ·
- 2026-07-01 m_bufferMapCount via getMappedRange State Confusion Leads to GPU OOB ·
- 2026-06-30 [GPUP] WebGPU BindGroup Validation-Cache Key Collision Leads to GPU OOB Write ·
- 2026-06-29 WebGPU importExternalTexture origin-clean bypass in Safari ·
- 2026-06-15 Concurrent HashMap access leads to MTE crashes ·
- 2026-05-29 Concurrent HashMap access leads to MTE crashes 2026-W21
- 2026-05-29 Concurrent HashMap access leads to MTE crashes
- 2026-03-24 REGRESSION(305413.218) http/tests/webgpu/webgpu/api/validation/buffer/mapping.html is a consistent Release text failure 2026-W12
- 2026-03-24 RemoteBuffer allows to write non-writable buffers, leading to shader's OOB accesses 2026-W12
- 2026-03-12 TOCTOU issue in `RemoteQueue::WriteBuffer`, leading to shader's OOB accesses 2026-W10
1 / 2
Hardening Commits
- 2026-06-15 Concurrent HashMap access leads to MTE crashes ·
- 2026-05-29 Concurrent HashMap access leads to MTE crashes 2026-W21
- 2026-05-29 Concurrent HashMap access leads to MTE crashes
Recent Commits
- 2026-08-07 Performance seems slower with attached shader in Safari
- 2026-08-04 executeBundles re-replays bundles containing indirect draws and reconstructs ICBs every call — 30× frame-rate collapse v
- 2026-07-30 TileController's visible size is not constricted to its parent
- 2026-07-30 libWebKitSwift.dylib is not loaded in some configurations
- 2026-07-28 Wgsl misscompilation `error: no member named 'xyz' in 'PackedVec3<float>'` (320443)
- 2026-07-22 [WebGPU] setPipeline fails for depth-only pipeline in a render bundle
- 2026-07-20 Update default inline model appearance
- 2026-07-16 Fix source breaking SDK change
- 2026-07-14 Adopt USDKit change to avoid large memory allocations
- 2026-07-14 [WebGPU] Subgroups
- 2026-07-14 Default WebGPU to enabled on VMs
- 2026-07-09 HTMLModelElement background color does not match spec text
- 2026-07-07 [WebGPU] RGBA16Float offscreen canvas appears opaque
- 2026-07-06 "Pipeline layout is invalid" opening grenzwert.net/wasm-modules/MedicalViewer/MedicalViewe
- 2026-07-03 Flash reloading models
1 / 13