This Week in WebKit — April 18–24, 2026

JSC's copy-producing methods read the array's length first to size the destination, then go back later for the source data. A Worker thread calling grow() in a tight loop will eventually land a call between those two reads — destination sized for the old length, copy source pointing at the new one. The regression test demonstrates the win in a few thousand iterations on commodity hardware.

WebContent asks the UI process for a sandbox extension before loading a local file, then forwards the extension token to the Networking process. When extension creation fails, WebContent just continues — and the Networking process, never told the access was denied, reads the file. Any compromised WebContent could pull local files without ever holding a valid extension.

GlobalVariableRewriter walks a HashMap to propagate length parameters into a struct definition. The walk inserts new entries into the same map, and when the map crosses its load-factor threshold it rehashes — moving the underlying storage out from under the active iterator. The rest of the walk reads memory that no longer belongs to the map. Reachable from any shader that compiles through this path.

MTE hardening turns on by reading a sysctl at libpas init. The CaptivePortal WebContent sandbox happens to block that sysctl — the read fails silently, libpas concludes MTE is unsupported on this CPU, and configures itself without it. The profile that's supposed to be the hardest target runs with weaker heap protections than a default WebContent.

A page can now have subframes spread across many processes, and BFCache has to coordinate suspension across all of them while a navigation is in flight. The new SuspendedPageProxy state machine tracks per-process state and reconciles it on commit. The interesting question is what happens when one of those processes crashes mid-suspend.