roberto-apple
WebCore security specialist
Summary
roberto-apple works primarily in the WebGL/ANGLE graphics path — ANGLE roll-ups, MSL translator fixes, and GL entry-point validation — with a secondary line of CSP and policy-container inheritance work in WebCore. The security fixes fall into two distinct clusters: missing or defeatable validation in ANGLE (baseVertex never checked against vertex buffer size, absent integer UB wrappers letting the compiler eliminate array bounds clamps, a DEPTH_COMPONENT32_OES/UNSIGNED_INT_24_8 format-type mismatch, a stale imageDef in the TextureMtl redefine fast path), and CSP dropped across context-creation boundaries (blob: URLs with multiple CSP headers, headerless SharedWorkers, WorkletGlobalScope, about:blank policy container inheritance). Systematic-variant candidate: the CSP cluster reads like a walk of every path that should copy a policy container from its creator, so the remaining exotic creators — srcdoc frames, javascript: URLs, nested worker chains — are the obvious next sweep; on the graphics side, other ANGLE entry points taking user-controlled base/offset indices are the parallel target.
Components
Security Fix History
- 2026-09-02 [WebGL] Reject offset-based GL calls when no buffer is bound 2026-W35
- 2026-09-01 [CSP] Nonce-based CSP is bypassed by dangling markup placed before a nonced <link> ·
- 2026-08-25 [ANGLE] MSL translator missing integer UB wrappers allow array bounds clamp elimination ·
- 2026-08-25 [ANGLE] Fix GL_DEPTH_COMPONENT32_OES format validation to reject GL_UNSIGNED_INT_24_8 ·
- 2026-08-24 [ANGLE] drawElements*BaseVertex* does not check baseVertex against the vertex buffer size
- 2026-08-13 about:blank inherits cross-origin policy container due to empty document URL ·
- 2026-07-18 CSP matches a script's content hash even for external scripts under strict-dynamic 2026-W29
- 2026-07-01 Clear stale imageDef in TextureMtl::redefineImage fast path ·
- 2026-07-01 [WebGL] Missing objectGraphLock on WebGL context restore races with GC ·
- 2026-06-14 Propagate CSP directives from the creating document to WorkletGlobalScope · CVE-2026-43670
Hardening Commits
Recent Commits
- 2026-09-11 Update ANGLE to 2026-09-07 (e3fdc27d77e3d066405f896da1d286b9232eae04)
- 2026-09-10 Update WebGL texture test expectations
- 2026-09-10 Update ANGLE to 2026-08-24 (9d57491334bdd2979bb7769f3ee9c4075d37465e)
- 2026-09-03 Update ANGLE to 2026-08-10 (e8d1a2c13248ac6d328a2fb5e35fa6580567ee1c)
- 2026-09-02 [WebGL] Reject offset-based GL calls when no buffer is bound 2026-W35
- 2026-09-01 [CSP] Nonce-based CSP is bypassed by dangling markup placed before a nonced <link> ·
- 2026-08-31 Update ANGLE to 2026-07-27 (ff4855759c68894b657ff346537fe5556ababd97)
- 2026-08-27 [ANGLE] Correctly rewrite unindexed interpolant array references
- 2026-08-26 [WebGL] Querying an unlinked WebGL program with a reserved name prefix incorrectly reports no error
- 2026-08-26 Update ANGLE to 2026-07-13 (ef84704aca0595b7e3c5b165efc4de81bfaa83d5)
- 2026-08-25 [ANGLE] MSL translator missing integer UB wrappers allow array bounds clamp elimination ·
- 2026-08-25 [ANGLE] Fix GL_DEPTH_COMPONENT32_OES format validation to reject GL_UNSIGNED_INT_24_8 ·
- 2026-08-24 [ANGLE] drawElements*BaseVertex* does not check baseVertex against the vertex buffer size
- 2026-08-19 REGRESSION(319079@main): TestWebKitAPI.WKNavigation.PreferredHTTPSPolicyAutomaticHTTPFallbackAfterTerminateProcess (api-
- 2026-08-13 [ANGLE] Avoid showing windows for dEQP tests