This Week in WebKit — May 09 - May 15, 2026

Security fixes

• ANGLE Metal: stale texture views during size transitions
  High ANGLE Metal backend
• GradientRendererCG: per-thread sampled gradient cache
  Medium WebCore CoreGraphics gradient renderer
• WKRevealItemPresenter: re-entrancy UAF in showContextMenu
  Medium WebKit UIProcess (macOS)
• WebCore::Color: MTE hardening for compact pointer in destructor
  Low WebCore graphics (Color value type)

Notable development

• JSPromise: inline reaction storage for single-handler .then(f)
• DFG/FTL: Object.defineProperty descriptor field extraction
• Site Isolation: multi-process BFCache restoration
• DFG/FTL: inline small Array.prototype.sort with comparator
• macOS IM: per-keydown command queue for Zhuyin TCIM
• JSC: inline allocation for Promise.resolve(non-thenable)
• JSC: cache isDefinitelyNonThenable on Structure
• JSC: cache Symbol.prototype.toString result
• JSC: PerformPromiseThenOneHandler for single-handler .then()
• MSE: B-frame tail PTS overshoot in coded-frame processing