mwyrzykowski
WebKit security specialist
Summary
mwyrzykowski works almost exclusively on WebGPU — the API implementation, its WGSL compiler, and the GPU-process plumbing behind it — with the remainder falling into WebCore and platform-level texture/IOSurface code. The security fixes cluster tightly on one theme: GPU-visible memory safety reached through validation gaps rather than through parsing or DOM state — index-clamp integer wraparound, `getMappedRange` map-count state confusion, bind-group validation-cache key collision, monotonic max-index tracking defeating cache invalidation, plus an `importExternalTexture` origin-clean bypass and a race producing reads from freed memory. Systematic-variant candidate: the caching and fast-path layers themselves, where a stale or colliding key turns a previously validated resource into an out-of-bounds access, and separately the WGSL→MSL backend, which has recurring reports of silent miscompilation (inlining over large structs, type-aliased array constructors) — codegen diverging from the program the validator actually approved.
Components
Security Fix History
- 2026-08-30 Race window lead to reads from deallocated memory · CVE-2026-43794
- 2026-08-29 Cache invalidation bypass via monotonic max-index tracking leads to GPU OOB read ·
- 2026-07-01 uint32 Wraparound in vsUintIndexClamp Leads to GPU OOB Read ·
- 2026-07-01 m_bufferMapCount via getMappedRange State Confusion Leads to GPU OOB ·
- 2026-06-30 [GPUP] WebGPU BindGroup Validation-Cache Key Collision Leads to GPU OOB Write ·
- 2026-06-29 WebGPU importExternalTexture origin-clean bypass in Safari · CVE-2026-43700
- 2026-06-15 Concurrent HashMap access leads to MTE crashes ·
- 2026-05-29 Concurrent HashMap access leads to MTE crashes ·
- 2026-03-24 REGRESSION(305413.218) http/tests/webgpu/webgpu/api/validation/buffer/mapping.html is a consistent Release text failure
- 2026-03-24 RemoteBuffer allows to write non-writable buffers, leading to shader's OOB accesses
Hardening Commits
Recent Commits
- 2026-09-14 WebGPU async pipeline creation stalls rendering
- 2026-09-13 Fix some failing CTS tests
- 2026-09-10 [WebGPU] Implement UTF-8 constant checking without string copies
- 2026-09-10 "bc1-rgba-unorm";dimension="3d" test cases are failing
- 2026-09-10 Add missing validation for overrides
- 2026-09-10 Factor out duplicated convertToColorSpace function
- 2026-09-09 [WebGPU] Very poor texture upload performance when passing canvas
- 2026-09-09 [WebGPU][WGSL] Three or more inlined calls to one function over a 256-byte struct silently miscompile on iOS
- 2026-09-09 WebGPU primitive points uncaptured error
- 2026-09-09 [WebGPU][WGSL] Array value constructor named through a type alias emits invalid MSL, silently producing wrong compute re
- 2026-09-09 [Apple5] WebGPU Renderbundles Device Destroyed ‘Device lost
- 2026-09-04 fix typo in IOSurfacePool.h
- 2026-09-03 webgpu.github.io/webgpu-samples/?sample=videoUploading does not play Lake with videoSource = videoElement
- 2026-09-02 GPUDevice.createBindGroup fast path is broken for external textures
- 2026-08-30 Race window lead to reads from deallocated memory · CVE-2026-43794