youennf
WebCore security specialist
Summary
youennf works primarily in WebCore and Platform, concentrated on media capture and WebRTC (getUserMedia, audio session and output device routing, libwebrtc) and on the fetch/Service Worker networking path — the most recent stretch is an in-progress implementation of fetch stream uploads, adding WebProcess→NetworkProcess IPC for streaming request bodies, backpressure, and duplex support. The security fixes cluster tightly around cross-process and cross-thread object lifetime: use-after-free in RemoteSampleBufferDisplayLayer via an off-main-thread error callback, in ServiceWorkerDownloadTask via a stale dispatcher queue, in libwebrtc RtpTransceiver codec state, and in the GPU process through MediaStreamTrack.clone() combined with ImageCapture.takePhoto() and applyConstraints() — plus a stack buffer overflow reached through attacker-supplied SDP simulcast layers. Systematic-variant candidate: the new stream-upload IPC surface, where the network process dereferences upload streams by identifier and abort, cancellation, and disturbed-body propagation are all freshly written — the same lifetime and state-machine shape as the UAFs already found in this author's media and download paths.
Components
Security Fix History
- 2026-07-03 [WebKit] Cross-thread use-after-free in RemoteSampleBufferDisplayLayer via off-main layerErrorDidChange() from FlushAndR ·
- 2026-07-02 Stack buffer overflow in WebKit libwebrtc VideoCodecInitializer via remote SDP simulcast layers leads to WebContent memo ·
- 2026-07-02 [WebKit] Use-after-free in ServiceWorkerDownloadTask via stale FunctionDispatcherQueue after second EstablishSWContextCo ·
- 2026-07-02 Safari & Chrome for iOS: Use-after-free in WebKit libwebrtc `RtpTransceiver` codec state reachable via `RTCRtpTransceive ·
- 2026-06-30 Heap UaF in GPU Process via MediaStreamTrack.clone() + ImageCapture.takePhoto() + applyConstraints() ·
- 2026-06-30 [WebCore] Data race on VideoFrameLibWebRTC::m_conversionCallback between clone and pixelBuffer causes use-after-free ·
- 2026-06-29 [WebCore] heap use-after-free in SWClientConnection::updateBackgroundFetchRegistration due to live HashTable iterator in ·
- 2026-06-29 [CoreIPC] RemoteVideoFrameObjectHeap::convertFrameBuffer uninitialized GPUP heap disclosure via SharedVideoFrameInfo byt ·
- 2026-06-29 [CoreIPC] RemoteVideoFrameObjectHeap::convertFrameBuffer uninitialized GPUP heap disclosure via SharedVideoFrameInfo byt ·
- 2026-06-15 Type Confusion in RTCEncodedStreamProducer.cpp Results in OOB Read ·
Hardening Commits
- No hardening commits recorded
Recent Commits
- 2026-07-31 getUserMedia audio permanently fails with NotAllowedError: No AVAudioSessionCaptureDevice after an audiomxd media‑servic
- 2026-07-31 Support stream upload back pressure in case of service worker reading the upload data
- 2026-07-30 m_isInvokingQueueDrainedHandler assertions are thread racy
- 2026-07-30 Service Worker request is missing sec-fetch-dest
- 2026-07-30 Implement fetch upload backpressure
- 2026-07-29 getUserMedia with echoCancellation:false still interrupts the microphone device system-wide on every capture start (unco
- 2026-07-29 Improve ability to get all chunks of PendingStreamState at once
- 2026-07-29 iOS Safari: `setSinkId()` returns success but audio output doesn't actually switch on single-track WebRTC MediaStream. W
- 2026-07-29 pendingStreamSchedule should not allow to call CFReadStreamSignalEvent before pendingStreamOpen
- 2026-07-28 Service worker fetch event request body cancellation should be propagated to the original ReadableStream
- 2026-07-28 Do not allow network fallback in case of a disturbed fetch event request body
- 2026-07-27 [Cocoa] Enable WebRTC AV1 by default
- 2026-07-27 Service workers should be able to get stream upload data
- 2026-07-25 WebResourceLoader constructor is crashing on GTK bots
- 2026-07-24 Stream uploads should fail in case of 401 responses