ruthvikkonda
WebCore security specialist
Summary
Primarily WebGPU and WGSL within WebCore, with secondary work on WebXR, Swift/Stream IPC message-receiver bindings, and a long run of unused-include removals. The security fixes cluster almost entirely in the WebGPU command-encoder path: validation state that survives across command buffers — a drawIndirect clamp cache poisoned by an unsubmitted encoder, a per-buffer slow-index-validation flag cleared between command buffers — both leading to GPU-side OOB vertex fetch, alongside lifetime races where `~CommandBuffer` runs on the Metal completion thread against non-atomic `CommandEncoder` refcounts, the same cross-thread RefCounted pattern also fixed in `WaveShaperProcessor`. Systematic-variant candidate: other per-encoder validation or clamp caches that aren't reset at submit boundaries, non-atomic RefCounted objects reachable from Metal completion handlers, and duplicate-IPC handling in the GPU/media proxies, where rejecting repeated `createBindGroup` entries and `createAudioSourceProvider` calls has already turned up bugs.
Components
Security Fix History
- 2026-09-08 [WebGPU] ~CommandBuffer can run on Metal completion thread, racing non-atomic CommandEncoder refcount and Device::m_comm 2026-W36
- 2026-09-02 [WebGPU] ~CommandBuffer can run on Metal completion thread, racing non-atomic CommandEncoder refcount and Device::m_comm ·
- 2026-08-31 [WebGPU] Unsubmitted command encoder can poison drawIndirect clamp cache leading to GPU OOB vertex fetch ·
- 2026-07-06 RemoteMediaPlayerProxy::createAudioSourceProvider should reject duplicate IPC 2026-W27
- 2026-07-02 [WebCore] Store WaveShaperProcessor curve as Vector<float> to avoid cross-thread RefCounted race ·
- 2026-07-02 [WebGPU] Per-buffer m_mustTakeSlowIndexValidationPath cleared between command buffers leads to GPU OOB vertex fetch ·
- 2026-07-01 Dynamic content scaling display lists should not be requested while preparing for display ·
- 2026-06-29 [WebGPU] Reject duplicate binding entries in Device::createBindGroup ·
- 2026-05-01 ANGLE: Metal: Add zero-init return for functions missing return statements
- 2026-04-29 ANGLE: Metal: Initialize missing fragment shader output components
Hardening Commits
- 2026-07-02 Use protect() instead of Ref { } in SVG animation and graphics code
- 2026-06-18 Use protect() instead of Ref/RefPtr { } in CSS code
- 2026-06-04 Use protect() instead of Ref/RefPtr { } in IPC code
- 2026-05-28 Reduce use of `.get()` for smart pointers in WebXR
- 2026-05-05 Use protect() instead of RefPtr { } in editing code
- 2026-05-01 ANGLE: Metal: Add zero-init return for functions missing return statements
- 2026-04-29 Use protect() instead of Ref { } in beacon and applepay code
- 2026-04-28 Use protect() instead of Ref { } in storage and speech code
- 2026-04-23 Use protect() instead of RetainPtr { } in WebGL code
- 2026-04-23 Reduce use of `.get()` for smart pointers in WebXRSystem
Recent Commits
- 2026-09-10 [WGSL] shader,validation,parse,comments:* is failing
- 2026-09-08 [WebGPU] ~CommandBuffer can run on Metal completion thread, racing non-atomic CommandEncoder refcount and Device::m_comm 2026-W36
- 2026-09-03 [WGSL] shader,validation,statement,discard:* is failing
- 2026-09-02 [WebGPU] ~CommandBuffer can run on Metal completion thread, racing non-atomic CommandEncoder refcount and Device::m_comm ·
- 2026-08-31 [WebXR] Remove unused WebXRSession.h include in XRWebGLSubImage
- 2026-08-31 [WebGPU] Unsubmitted command encoder can poison drawIndirect clamp cache leading to GPU OOB vertex fetch ·
- 2026-08-18 [model] Remove unused AbortSignal.h include in HTMLModelElement
- 2026-08-11 [WebXR] Remove unused WebGPUXRView.h include in XRGPUBinding
- 2026-08-06 [model] Remove unused <limits> include in LazyLoadModelObserver
- 2026-08-05 [WebGPU] Remove unused WebGPUDowncastConvertToBackingContext.h include in WebGPUImpl
- 2026-08-05 Swift IPC message receivers cannot be annotated with EnabledBy
- 2026-07-29 [WebXR] Remove unused Scope.h include in WebXRWebGLLayer
- 2026-07-29 Stream IPC message receivers can dispatch synchronous messages to Swift
- 2026-07-27 Stream IPC message receivers can call directly into Swift
- 2026-07-24 [model] Remove unused GraphicsLayerCA.h include in HTMLModelElement