xeenon
WebCore contributor
Summary
xeenon works almost exclusively on the Web Extensions surface of the WebKit API layer — WKWebExtensionController configuration and datastore lifecycle, content-script/background message passing, cookies and declarativeNetRequest — with a secondary line in text extraction and WKWebView snapshot APIs. The security fixes land in that same area rather than in the engine: a use-after-free in `_WKWebExtensionDeclarativeNetRequestRule` resource resolution and a `safari-web-extension` URL masking bypass, plus cherry-picked rdar-tracked fixes; nothing in the window is classified as hardening. Systematic-variant candidate: the extension-to-page trust boundary. URL masking, user-gesture propagation through `sendMessage()`/`connect()`/`postMessage()`/`executeScript()`, non-persistent datastore defaults, and popup WKWebView teardown are all commits against the same boundary, and the object-lifetime bugs (popup views not released, flaky teardown assertions) sit next to the one UAF already found there.
Components
Security Fix History
- 2026-07-01 Cherry-pick ef8d2c8530b9. rdar://175672652 ·
- 2026-07-01 Cherry-pick 0a9952c703a7. rdar://176483124 ·
- 2026-07-01 Cherry-pick 95c175bca8d0. rdar://176570738 ·
- 2026-07-01 Use-after-free in -[_WKWebExtensionDeclarativeNetRequestRule _resourcesToTargetWhenNoneAreSpecifiedInRule] on concurrent ·
- 2026-04-29 safari-web-extension url masking bypass. 2026-W17
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-07-21 WKWebView._takeSnapshotOfNode() should support ImageData and OffscreenCanvas.
- 2026-07-20 [Text Extraction] Add option to include tag names for blocks with inline children.
- 2026-07-08 WKWebExtensionController.Configuration.nonPersistent() should use a non-persistent datastore by default.
- 2026-07-01 Cherry-pick ef8d2c8530b9. rdar://175672652 ·
- 2026-07-01 Cherry-pick 0a9952c703a7. rdar://176483124 ·
- 2026-07-01 Cherry-pick 95c175bca8d0. rdar://176570738 ·
- 2026-07-01 Use-after-free in -[_WKWebExtensionDeclarativeNetRequestRule _resourcesToTargetWhenNoneAreSpecifiedInRule] on concurrent ·
- 2026-06-30 Cherry-pick 343f135c4791. rdar://175672573
- 2026-06-28 runtime.sendMessage from a content script is dropped if sent while the background content is still loading.
- 2026-06-15 Inconsistent straight quotes ("%@") and curly apostrophe (extension’s) in same string (2 strings).
- 2026-06-03 [AutoFill Debugging] Add WKWebView method to apply debug text extraction filter rules to an arbitrary string.
- 2026-05-22 Web Extensions: cookies.get() and cookies.getAll() have empty results on first launch.
- 2026-05-12 REGRESSION(285929@main-285928@main): [ iOS Debug ] WKWebExtensionAPI* tests are flaky timeout.
- 2026-05-11 Loading any Web Extension breaks Cloudflare bot challenges
- 2026-05-08 Web Extensions popup WKWebView and NSPopover are not released when the popup is dismissed on macOS.