◆ WebKit WeeklyBeta

roberto-apple

WebCore security specialist

79 commits (10mo)
18 security fixes
1 hardening
View all commits on GitHub ↗

Summary

Primarily WebCore, split between Content Security Policy enforcement and the ANGLE/Metal WebGL backend, with adjacent Platform and Site Isolation work. The security fixes cluster tightly around CSP inheritance into contexts that don't carry their own headers — SharedWorkers from headerless URLs, blob: URLs with multiple CSP headers, WorkletGlobalScope, opaque-origin documents — alongside directive-matching bugs like strict-dynamic hash matching on external scripts and script-src/connect-src confusion for JSON module imports; the remainder are Metal-backend memory errors (stale imageDef on texture redefinition, OOB vertex attribute offsets, a missing objectGraphLock racing GC on context restore). Systematic-variant candidate: the CSP inheritance path for every remaining derived-context type that inherits policy rather than parsing it — the same class of bug has surfaced repeatedly across different global-object constructions here.

Components

WebCore
41%
Platform
16%
Site Isolation
15%
WebGPU
13%
WebKit
10%
WebGL
3%

Security Fix History

1 / 2

Hardening Commits

Recent Commits

1 / 6

← All Contributors