youennf
WebCore security specialist
Summary
youennf works almost entirely in WebCore's media and networking stack — WebRTC capture/encode pipelines and LibWebRTCCodecs, the network process RTC socket layer (UDP/TURN, DNS resolution policy flags), and fetch/ServiceWorker/CacheStorage plumbing. The security fixes cluster tightly in WebRTC codec glue: bounds errors in the H.264/H.265 and VP9 encoder wrappers, odd-width I420/I010 handling in copyVideoFrameBuffer, integer truncation while parsing AV1 OBU sizes, and a missing bounds check on RTCEncodedVideoFrameMetadata.contributingSources — with a secondary thread-safety strand (unsynchronized cross-thread map access in CacheStorageConnection, a RemoteVideoDecoderCallbacks race yielding a UAF). Several of these landed on the same day, which reads as one sweep rather than isolated reports; the frame-geometry and RTP header parsing paths reachable from RTCRtpScriptTransform and getUserMedia constraints are the natural place to continue that sweep.
Components
Security Fix History
- 2026-09-09 Heap Buffer Overflow in WebRTC VP9 Encoder 2026-W36
- 2026-09-02 Out-of-bounds read in -[RTCVideoEncoderH265/H264 frameWasEncoded:] — AppendData uses total CMBlockBuffer size instead of ·
- 2026-08-28 [WebRTC] Out-of-bounds write in copyVideoFrameBuffer for odd-width I420/I010 frames ·
- 2026-08-26 [WebRTC] Out-of-bounds write in copyVideoFrameBuffer for odd-width I420/I010 frames ·
- 2026-08-26 int truncation of OBU size in RtpPacketizerAv1::ParseObus ·
- 2026-08-26 missing bounds check in RtpPacket::SetCsrcs for RTCEncodedVideoFrameMetadata.contributingSources ·
- 2026-08-26 Unsynchronized cross-thread access to m_opaqueResponseToSizeWithPaddingMap in CacheStorageConnection::computeRecordBodyS ·
- 2026-08-26 Incomplete replacementPath validation in NetworkConnectionToWebProcess::registerInternalFileBlobURL ·
- 2026-08-26 Race on RemoteVideoDecoderCallbacks::m_timestampToDuration leads to use-after-free ·
- 2026-07-03 [WebKit] Cross-thread use-after-free in RemoteSampleBufferDisplayLayer via off-main layerErrorDidChange() from FlushAndR ·
Hardening Commits
- 2026-09-10 Add a flag to control whether allowing WebRTC to resolve DNS directly
- 2026-08-26 New Test(316184@main): [macOS Debug] fast/mediastream/applyConstraints-with-takePhoto.html is a flaky CRASH
- 2026-07-29 pendingStreamSchedule should not allow to call CFReadStreamSignalEvent before pendingStreamOpen
- 2026-07-28 Do not allow network fallback in case of a disturbed fetch event request body
- 2026-06-03 Add missing null checks when calling internal stream functions
- 2026-05-21 vp9_scale_references: fail if no free buffer is available (Potential 'overflow' issue committed to upstream libwebrtc) ·
- 2026-05-20 Validate identifiers when creating decoders and encoders in LibWebRTCCodecsProxy 2026-W20
- 2026-04-15 Callers of WebSWServerConnection::checkTopOrigin should return early if check fails
- 2026-03-12 Parsing multipart form data should check that the boundary is followed by CRLF or "--"
Recent Commits
- 2026-09-17 Introduce WebRTCVideoEncoder to support WebCore-implemented video encoders in LibWebRTCCodecs
- 2026-09-10 Add a flag to control whether allowing WebRTC to resolve DNS directly
- 2026-09-09 Heap Buffer Overflow in WebRTC VP9 Encoder 2026-W36
- 2026-09-09 Allow TURN UDP port to open a socket even if DNS resolution fails
- 2026-09-09 NetworkRTCUDPSocketCocoa should not filter AF_UNSPEC remote addresses
- 2026-09-08 LibWebRTCNetwork::SignalReadPacket should take a SocketAddress
- 2026-09-03 WPT fetch/range/non-matching-range-response.html subtest is failing
- 2026-09-03 dibsido QR scanner camera preview is not rendering
- 2026-09-02 Out-of-bounds read in -[RTCVideoEncoderH265/H264 frameWasEncoded:] — AppendData uses total CMBlockBuffer size instead of ·
- 2026-08-31 ServiceWorkerThread can fire events while its related scope is stopped
- 2026-08-28 [WebRTC] Out-of-bounds write in copyVideoFrameBuffer for odd-width I420/I010 frames ·
- 2026-08-27 REGRESSION: streaming fetch() body is withheld until the next network chunk when the reader is busy
- 2026-08-27 Add a flag to support disabling WebRTC private relay bypass
- 2026-08-27 NetworkConnectionToWebProcess::establishSWContextConnection hits MESSAGE_CHECK(swServer->hasPendingConnectionDomain({ si
- 2026-08-27 Resync dav1d up to M152