shallawa
WebCore security specialist
Summary
Works primarily in WebCore graphics and imaging — filter effects (FEMorphology, FEGaussianBlur, FEColorMatrix), image decoding, ImageBuffer/PixelBuffer handling, and the GPU Process paths that back them — with recent feature work on HTML-in-Canvas and WebCodecsImageDecoder. The security cluster is tightly themed rather than scattered: uninitialized pixel data escaping filter and getPixelBuffer paths, thread-safety violations in software filter appliers and PathCG now that decoding runs off the main thread, plus length validation on filter parameters arriving over IPC, alongside a raw-renderer-pointer use-after-free in SVG geometry. Systematic-variant candidate: the remaining software filter appliers and ImageBuffer backend combinations, since the same two bug shapes — uninitialized output buffers and main-thread assumptions broken by async decoding — have each recurred across multiple distinct filters here.
Components
Security Fix History
- 2026-07-01 putPixelBuffer() and getPixelBuffer() should never be called for PDF and DisplayList ImageBufferBackends ·
- 2026-07-01 REGRESSION(305413.516@safari-7624-branch): The height of the FEMorphology filter might be off by 1 ·
- 2026-06-30 GetPixelBuffer should zeroFill the destination if any error happens ·
- 2026-06-30 Uninitialized result of FEGaussianBlur if the input isAlphaImage ·
- 2026-06-30 Use-after-free in SVGGeometryElement::getPointAtLength — raw renderer pointer held across nested updateLayout ·
- 2026-06-30 FilterImage may return uninitialized PixelBuffer ·
- 2026-06-29 PathCG::strokeContains() is not thread safe ·
- 2026-06-16 [GPU Process]: Before decoding FEColorMatrix validate the length of the `values` vector ·
- 2026-06-15 FEMorphologySoftwareApplier is not thread safe ·
- 2026-06-12 Before creating a remote AVF image decoder, the mime-type should be checked if it is supported ·
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-08-05 Implement the IDL changes for WebCodecsImageDecoder
- 2026-08-04 Introduce `AsyncImageDecoder`
- 2026-08-03 [HTML-in-Canvas] Implement the IDL changes for HTML-in-Canvas
- 2026-07-29 [HTML-in-Canvas] Import HTML-inCanvas WPT tests
- 2026-07-28 [HTML-in-Canvas] Add a feature control flag to enable HTML-in-Canvas
- 2026-07-28 Async image decoding may be requested on a worker thread
- 2026-07-06 FilterRenderingOption::FastAndLowQuality should be added to serialization.in
- 2026-07-02 [HDR] Ensure that parsing the gain-map target pixelFormat is handled correctly
- 2026-07-01 putPixelBuffer() and getPixelBuffer() should never be called for PDF and DisplayList ImageBufferBackends ·
- 2026-07-01 REGRESSION(305413.516@safari-7624-branch): The height of the FEMorphology filter might be off by 1 ·
- 2026-06-30 REGRESSION(312893@main): ASSERT(m_decodedSize >= decodedSize) in BitmapImageSource::decodedSizeReset()
- 2026-06-30 GetPixelBuffer should zeroFill the destination if any error happens ·
- 2026-06-30 Uninitialized result of FEGaussianBlur if the input isAlphaImage ·
- 2026-06-30 Use-after-free in SVGGeometryElement::getPointAtLength — raw renderer pointer held across nested updateLayout ·
- 2026-06-30 FilterImage may return uninitialized PixelBuffer ·