This Week in WebKit — June 27 - July 03, 2026

Snapshotting clients into strong refs keeps them alive — so the loop looks safe. Alive isn't the same as still registered, and one callback can sever the difference.

→ Use-after-free in CSSFontFace::setStatus via CSSFontFace::load WebCore CSS font loading

Security · High

Name a file in a window.open request body, get a read token back

A sibling IPC handler learned to check file authorization months ago. This one never got the memo — and from a compromised renderer, that gap reads arbitrary host files.

→ WebPageProxy::createNewPage missing sandbox-extension check on request httpBody WebKit UI process

Development · bug

A cross-origin iframe was handed a live pointer to its parent's DOM

sourceElement assumed both frames share an origin. Dispatched into a cross-origin child, its ownerDocument walks straight into the parent — no prompt, no gesture.

→ Cross-origin parent DOM exposed via NavigateEvent.sourceElement

Security fixes

Use-after-free in LocalFrameView::scrollToAnchorFragment via NavigateEvent finish
High WebCore Navigation API / frame scrolling
Data race in JSStyleSheet::visitAdditionalChildren during GC leading to use-after-free
Medium WebCore CSSOM ↔ JSC GC boundary

Notable development

[CoreIPC] [GPUP] off-main-thread ~RemoteAudioMediaStreamTrackRendererInternalUnitManagerUnit mutates unlocked AudioSession interruption-observer WeakHashSet
bug

Other security-relevant changes

[WebKit UIProcess / WebPageProxy] (sandbox bypass) 248f89a — Added MESSAGE_CHECK_URL to WebPageProxy::didFailLoadForFrame to prevent a compromised WebContent process from forging file:// failingURLs and gaining read access to arbitrary directories in UI and Network processes.
[WebCore CoreImage] (OOB read) 88ab9e1 — Empty tableValues in FEComponentTransfer caused CoreImage Metal kernel to skip lower bound clamping in table index calculation, yielding tableStart[-1] dereference. Leaked GPU process memory to compromised WebContent process via IOSurface.
[WebCore WebXR] (UAF) 2b68a68 — Fixed use-after-free in WebXRSystem where async IPC reply callbacks captured raw this pointers; iframe removal + GC could free the object before queued tasks executed, causing freed memory reads and member writes.
[WebCore Streams] (Type confusion) 87d2036 — Changed unconditional jsCast to jsDynamicCast in ReadableStream.cancel() to prevent type confusion when Promise[Symbol.species] is overridden to return a non-Promise object.
[JSC DeferredWorkTimer] (UAF, type confusion) 15c117a — Fixed use-after-free in DeferredWorkTimer where Wasm compiler tasks captured raw Ticket pointers; TZone allocator slot reuse caused stale pointers to match fresh tickets at the same address. Now uses weak references with mandatory liveness checks.
[libwebrtc video codec] (stack buffer overflow) e8a476c — Fixed stack buffer overflow in libwebrtc's VideoCodecInitializer triggered by remote SDP with excessive simulcast layers; attacker could corrupt WebContent memory via crafted WebRTC offer. Patch adds bounds checking on simulcast encodings and promotes debug check to release check.
[WebCore WebAudio] (race condition UAF) 8912cf5 — Heap-use-after-free from non-atomic RefCounted race on WaveShaperProcessor curve between main and audio threads; concurrent refcount operations could free the Float32Array buffer mid-render. Fixed by storing curve as Vector.
[WebKit UIProcess] (sandbox bypass) 198d4db — Fixed sandbox escape allowing compromised WebContent to inject arbitrary file paths via EncodedFileData and obtain filesystem access. Now validates paths against previously user-approved selections before granting sandbox extensions.
[WebCore Permissions] (UAF, race condition) 4aaa3c1 — Fixed UAF where cross-thread destruction race on worker DeferredPromise allowed the promise object (worker-owned) to be freed on the main thread when navigator.permissions.query() was called in a worker followed by worker.terminate().
[WebGPU Buffer] (OOB read) cf0a14a — Index buffer validation flag cleared prematurely between command buffers, allowing drawIndexed to skip re-validation and execute against attacker-controlled out-of-bounds indices. Fix defers flag clearance until all pending encoders complete their precommit validation.
[WebKit NetworkProcess / ServiceWorker] (UAF) a3c2559 — Added MESSAGE_CHECK in NetworkConnectionToWebProcess to prevent use-after-free in ServiceWorkerDownloadTask caused by a compromised WebContent process establishing SW context connection twice, destroying the prior connection without closing it.
[WebKit UIProcess back/forward list] (validator bypass) 074d380 — Converted debug-only assertion to MESSAGE_CHECK in back/forward item validation, preventing a compromised WebContent process from spoofing cross-process items to access file:// URLs.
[WebKit UIProcess] (sandbox bypass, file write) f23ffb5 — Fixed vulnerability: compromised renderer could navigate to data: URL with unshowable MIME type, triggering automatic download to write attacker-controlled bytes to ~/Downloads without user interaction. Now blocks PolicyAction::Download on data: URLs unless API-client-initiated.
[WebCore async-clipboard] (UAF) c5036aa — Fixed heap use-after-free in async clipboard caused by reentrant clearItemTypeLoaders() calls. Swapped vector contents to local variable before iteration to prevent mutation of the container during traversal.
[WebCore DOM] (UAF) cb83583 — Fixed use-after-free of Document in trustedTypeCompliantString by deploying smart pointers; vulnerability was triggered when srcdoc iframes with trusted types policies were removed during garbage collection.
[WebCore HistoryController] (UAF) efe4920 — Fixed use-after-free in HistoryController::recursiveGoToItem when popstate handlers fire during history.back(), triggering m_children reallocation mid-iteration; web-reachable via iframe injection.
[GPUProcess UserMediaCaptureManagerProxy] (race condition, UAF, write-after-unmap) 866892a — Fixed race condition in UserMediaCaptureManagerProxy where repeated StartProducingData IPC calls trigger heap-use-after-free and write-after-unmap of audio ring buffers when GPU main thread and background WorkQueue access shared state without synchronization.
[ANGLE Metal TextureMtl] (OOB write) b3a1859 — Cleared stale per-level texture views that survived storage reallocation in TextureMtl. When a subsequent texImage2D took the fast path and fetched the stale undersized view, replaceRegion would write past its bounds. Exploitable via WebGL resize sequences.
[WebCore fileapi] (UAF) 629adf4 — Changed AsyncFileStream::read to take ThreadSafeRefCounted Box instead of span, ensuring the buffer outlives the background thread writing to it. Fixes cross-thread UAF write reachable via Blob URLs.
[WebKit UIProcess] (site-isolation bypass) 6703af8 — Prevented a compromised renderer from forging treatAsSameOriginNavigation in IPC to skip cross-site process swaps; field now computed server-side in UIProcess.
[WebKit WKMouseInteraction] (UAF) ffe2ea6 — Fixed use-after-free in iOS WKMouseInteraction triggered by successive pointer lock IPCs; unretained block copy was freed when replaced, leaving dangling pointer on subsequent lock. Adopted BlockPtr retention and added state validation.
[WebCore WebXR] (UAF) 3a88b7c — Fixed use-after-free in WebXR XRSessionInit where sequence held JSValues that garbage collection could free. Changed to sequence with eager Vector copy; added static asserts to block future unsafe sequence/FrozenArray adoption.
[WebCore WebGL] (race condition, UAF) 034f2fb — Added objectGraphLock during WebGL context restoration to prevent race condition where concurrent GC could access freed WebGLTransformFeedback and WebGLVertexArrayObject objects.
[WebCore Document] (UAF) ccb3ee3 — Protected SecurityOrigin when service workers navigate clients, preventing use-after-free exploitable via ArrayBuffer-based heap grooming and document open/close cycles.
[WebCore Blob] (race condition) d643555 — Fixed UAF from cross-thread race on BlobData/BlobDataFileReference destruction. BlobData was ThreadSafeRefCounted but held non-thread-safe members; background threads could free them while main thread held references. Hardened via main-thread-only destruction.
[WebCore iOS Pasteboard] (sandbox bypass) 1dc6a86 — Fixed case-sensitive type validation allowing case-variant bypass; compromised WebContent could send 'Com.Apple.UIKit.Image' to route bytes through NSKeyedUnarchiver/ImageIO in UI process. Replaced with case-insensitive prefix matching and added missing gate to readString.
[WebCore Streams] (type confusion) 8fd92b1 — Array.prototype[Symbol.iterator] override allowed type confusion in TransformStream via object substitution, enabling controlled derefs and vtable calls; bypassed ASSERT-only guards. Fixed by adding runtime size/null-checks with TypeError validation.
[WebKit NetworkProcess] (sandbox bypass) c312747 — Compromised WebContent could poison the persistent cache by injecting 301 redirects for arbitrary cross-origin partitions via attacker-supplied responses used before partition restoration. Fix hoists partition restoration and adds MESSAGE_CHECKs at IPC boundaries.
[NetworkProcess SharedWorker] (validator bypass) 019c43f — Added MESSAGE_CHECK_COMPLETION to validate the Site parameter received from WebContent before establishing SharedWorker context connections, preventing a compromised renderer from hijacking connections for arbitrary domains.
[WebCore AudioEncoder] (UAF) b48b4d4 — Fixed use-after-free in InternalAudioEncoderCocoa when encode() replaces converter without keeping it alive; old drain fires into freed encoder if close() called mid-drain, exploitable via PCM format change sequence.
[GPU Process / MediaCapture] (UAF) 54b8e49 — Captures media constraints by value instead of reference in async callback, preventing heap UAF in GPU process when concurrent takePhoto and applyConstraints operations race on cloned track.
[WebKit UIProcess PDF] (Path traversal, sandbox bypass) b12f122 — Percent-encoded path separators in PDF filenames bypassed sanitization, allowing a compromised web content process to write files outside the temporary directory. Fixed by percent-decoding filenames before sanitization and validating they are single path components.
[WebCore Web Audio] (race condition, UAF) 2f91fd7 — Takes graphLock() in BiquadFilterNode::setType() to prevent race with audio-thread kernel reallocation; prevents UAF when main thread loads freed kernel pointer from m_kernels Vector, potentially causing virtual dispatch into destroyed BiquadDSPKernel.
[WebKit NetworkProcess / loadPing] (validator bypass) 6aa96bc — Added MESSAGE_CHECK in loadPing() to validate firstPartyForCookies, preventing a compromised web process from forging cross-origin URLs and exfiltrating cookies from unrelated origins.
[WebCore SVG] (UAF) a93904b — Cached raw renderer pointer in getPointAtLength() became stale when nested getTotalLength() triggered updateLayoutIgnorePendingStylesheets(), causing UAF on the renderer object. Fixed by eliminating the cache and deferring renderer access until immediately before use.
[WebKit ITP] (IPC validator bypass) 5044a54 — Validates ResourceLoadStatisticsUpdated, LogUserInteraction, and RequestStorageAccessUnderOpener IPC messages to prevent a compromised WebContent process from forging ITP database entries and obtaining cross-origin cookie access without user prompt.
[JSC DFG] (UAF) 2620d0d — Added write barrier for MultiPutByOffset when object storage reallocates. Without it, generational GC could collect new-generation objects still referenced from old-generation, causing use-after-free.
[WebKit Extensions Storage] (UAF) d9783c3 — Fixed heap use-after-free in storageSet triggered when SQLite batch insert fails mid-batch — iterating data.keys() while removing entries left the iterator dangling as HashMap mutations freed the buffer, creating a UI Process UAF reachable from compromised renderer via IPC.
[WebCore WebCodecs] (UAF) e147963 — Fixed heap-use-after-free in WebCodecsAudioData::memoryCost() caused by concurrent GC marker thread dereferencing freed PlatformRawAudioData while main thread nulled RefPtr in close(). Memory cost now cached in atomic.
[WebCore IDB Server] (UAF) 16b1bde — Fixed heap use-after-free in IDB reverse cursors when iterating after the next-higher index entry is deleted; the std::reverse_iterator's base node becomes dangling and subsequent increment operations dereference freed memory.
[WebGL GPU process] (heap disclosure) 8c0e20b — Fixed heap disclosure in readPixelsInline: switched from tryMalloc to tryZeroedMalloc, preventing uninitialized GPU-process memory from being returned to WebGL readPixels().
[WebCore graphics / PixelBufferConversion] (uninitialized disclosure) b690833 — convertImagePixelsFromFloat16ToFloat16() early-returned without writing destination buffer, leaving uninitialized Gigacage::Primitive heap bytes that were memcpy'd into WebContent-mapped shared memory, causing WebContent<->GPUProcess heap disclosure.
[WebGPU] (key collision) 144aa0d — Validation-cache key collision in WebGPU bind group validation allowed compute-validated bind groups to pass render pipeline validation, enabling GPU out-of-bounds writes via pipeline ID collisions.
[WebCore canvas] (UAF) 040ef6e — Fixed UAF in canvas getContext() where re-entrant dictionary conversion could cause m_context overwrite while JS wrapper remains live; wrapper deref() reads freed memory on GC sweep.
[WebCore AutoFillButtonElement] (UAF) fac72c7 — Fixed use-after-free in AutoFillButtonElement::defaultEventHandler: JavaScript can change input.type mid-click dispatch, freeing TextFieldInputType while EventPath preserves the button, enabling virtual call hijacking from web content.
[WebKit CoreIPC NSURLRequest] (sandbox bypass) a38f039 — Stopped forwarding body and bodyParts fields in CoreIPCNSURLRequest; CFNetwork interprets NSString entries as POSIX file paths, allowing a compromised WebContent process to exfiltrate arbitrary files from NetworkProcess.
[WebKit NetworkProcess / ResourceLoader] (sandbox bypass) 64315b6 — Adds MESSAGE_CHECK validation in redirect handling to prevent compromised WebContent process from modifying firstPartyForCookies to access cross-origin cookies. Validates that any origin modification matches the process's allowed-list.
[JSC DFG] (UAF) 13bfbf9 — Prevents constant-folding of backing store pointers for resizable/growable-shared TypedArray views; after WebAssembly.Memory.grow() reallocates the vector, stale pointers enable out-of-bounds writes.
[WebKit UIProcess / WebFrameProxy] (type confusion) 15c722b — Fixed wrong-container end() comparison in WebFrameProxy allowing orphaned frames to evade detection; compromised WebContent could inject a cross-page frame into the UI process's focused frame, causing type confusion and EXC_ARM_PAC_FAIL during traversal.
[WebCore CloseWatcher] (UAF) ae9baa4 — Fixes use-after-free in CloseWatcher::destroy() triggered when AbortSignal lambda executes via WeakPtr after CloseWatcherManager holds the last Ref. Converts WeakPtr to RefPtr to keep the watcher alive during deallocation.
[WebKit Process Model] (sandbox bypass) e9f94fd — Missing sender-ownership validation in 12 IPC handlers allowed compromised WebContent to brute-force sibling tab IDs and access cross-tab security state; fixed by adding MESSAGE_CHECK assertions at each handler.
[WebCore AVFoundation] (race condition, UAF) d4b40e1 — Fixed cross-thread UAF in flushAndRemoveImage @catch path: background-queue error handler dereferenced non-thread-safe WeakPtr to SampleBufferDisplayLayerClient while main thread released the RemoteSampleBufferDisplayLayer.
[UIProcess RemoteScrollingTree] (UAF, race condition) 6a97574 — Fixed cross-thread use-after-free: m_progressBasedTimelineRegistry was freed on main thread while ScrollingThread read it unsynchronized, triggerable via scroll-driven animation toggles with rapid scrolling.
[WebCore MessagePort] (validator bypass) 899dd99 — Fixed MessagePort ownership validation in Network Process to prevent compromised WebContent from forging close, entangle, or disentangle operations on other processes' ports via spoofed ProcessIdentifier.
[WebKit RemoteObjectRegistry] (authorization bypass) 972966a — Prevents a compromised WebContent process from sending IPC messages to _WKRemoteObjectRegistry of an unrelated WebPageProxy in the same pool, which could enable arbitrary Objective-C method invocation on objects registered by a different page.
[WebGPU] (validator bypass) 97e8c4b — PipelineLayout::makeInvalid() left std::optional engaged while clearing the vector, causing validation to skip. Poisoned layouts reached Metal dispatch with incompatible argument buffers, triggering GPU out-of-bounds access, reachable via getBindGroupLayout(index).
[WebKit IPC] (sandbox bypass) 7e6fba5 — Fixed IPC validator accepting empty sandbox extension handles in FormDataReference; moved validation to constructor to prevent sandbox escape via crafted IPC messages on Cocoa platforms.
[WebCore XSLT] (UAF) a8459d4 — Heap UAF where libxslt frees imported stylesheets on compile failure, leaving dangling m_stylesheetDoc pointers; delayed subresources in multi-level XSL import chains trigger use-after-free in parseString(), reachable via XML processing instructions.
[WebCore FocusController] (UAF) 87fedd8 — Fixed use-after-free in focus traversal where a blur event handler removing a document could leave dangling pointers during focus element search; patched by adopting smart pointers in FocusController.
[WebKit NetworkProcess IDB blob validation] (validator bypass) 5be1236 — Tightened blob path validation from directory-level to per-file grants; prevented WebContent from registering file-backed blobs pointing to other origins' IDB storage, blocking cross-origin data exfiltration.
[WebCore mediastream] (UAF) a14d1c0 — Fixed use-after-free in RtpTransceiver codec state reachable via setCodecPreferences() after RTCPeerConnection garbage collection; added no-op guard when connection closed.
[WebCore TextTrack] (data race, UAF) e379531 — Data race between GC thread reading TextTrackCue::m_track and main thread nulling it led to use-after-free; fixed by adopting CheckedPtr and adding synchronization locks, web-reachable via HTML media TextTrack API.
[WebKit Extensions / SQLiteStore] (race condition, UAF) abe6e82 — Fixed heap use-after-free in Web Extensions SQLiteStore where weak-null early-return paths invoked completion handlers on background WorkQueue instead of main thread, causing concurrent HashMap mutations during extension reload. Dispatches handlers to main thread in affected paths across three store subclasses.
[WebKit GPUProcess graphics] (information disclosure) 6a20a3d — Upgraded ASSERT_NOT_REACHED to RELEASE_ASSERT_NOT_REACHED and added MESSAGE_CHECK guards to prevent uninitialized PixelBuffer from PDF/DisplayList backends being sent over IPC. Release builds would serialize uninitialized GPU heap memory to WebProcess.
[WebKit WebFrameProxy] (hardening) c344219 — Validates security-critical fields (isMainFrame, securityOrigin, topOrigin, frameID, URL) against UI-process ground truth; previously these WebProcess-supplied values were trusted without verification. Overwrites mismatches and logs instead of crashing.
[WebKit / Extensions] (race condition) 4e721b0 — Use-after-free from concurrent ref/deref races in WebExtensionSQLiteDatabase between WorkQueue and UI thread; adopted ThreadSafeRefCounted for atomic refcount updates.
[WebKit NetworkProcess] (hardening) b4165ba — Adds MESSAGE_CHECK to PreconnectTo handler to reject HTTP-body payloads from WebContent, preventing a compromised renderer from forcing network requests.
[WebKit Extensions API] (UAF) 1759ab2 — Fixed UAF in WebExtension port listener dispatch: adding listeners during onMessage/onDisconnect callbacks could reallocate the vector, leaving the loop iterator dangling into freed memory. Copies listeners before iteration to prevent this.
[WebExtension SQLite stores] (race condition, UAF) 6d6ea48 — Fixed race condition in WebExtension SQLite stores where JSON::Object Refs captured in WorkQueue lambdas were subject to concurrent refcount updates from main and worker threads, causing premature deallocation and heap-use-after-free on the WorkQueue.
[WebGPU Device] (uint32 wraparound, OOB read) 0077500 — Fixed uint32 wraparound in index buffer clamping via saturating addition, preventing bypass of bounds checks and GPU out-of-bounds reads through attacker-controlled indices.
[WebGPU RemoteBuffer] (race condition) ce589a4 — Prevented state confusion where m_bufferMapCount could go negative via IPC, causing getMappedRange() to proceed with inconsistent buffer state and enabling concurrent GPU writes to attacker memory.
[WebKit NetworkProcess] (sandbox bypass) ec611da — Fixed bypass allowing subsequent local file loads (e.g., HTTP redirects to file://) to skip sandbox extension checks; now all file:// requests are validated regardless of load order.
[JSC WasmGC] (validator bypass) 5df8b0b — Added validation of reserved bits to br_on_cast flags; validator previously allowed null to pass non-null type checks via misinterpreted flag bytes.
[WebKit NetworkProcess] (sandbox bypass) 022bc68 — Prevents Network process from creating sandbox extensions for form uploads to protected system directories, blocking a compromised renderer from tricking it into granting itself read access to sensitive paths.
[WebCore web-locks] (UAF) 7a5ee54 — Fixes cross-thread use-after-free where WebLockManager::query()'s completion handler captured worker-thread DeferredPromise that was destroyed on main thread when handler never invoked.
[JSC DFG] (type confusion) d75a9fd — Fixed DFG caching property absences on dictionary structures that add properties at runtime without transitioning, preventing type confusion from stale cache.
[WebKit NetworkProcess] (IPC validation bypass) c5fabb4 — Removed unvalidated IPC field that allowed a compromised WebContent process to bypass response header sanitization (Set-Cookie stripping, cross-origin filtering) by setting shouldRestrictHTTPResponseAccess to false.
[JSC Structure] (Proxy invariant bypass) 336c35e — Fixed stale HasNonConfigurableProperties bit in SlowPutArrayStorage structures, preventing Proxy handlers from bypassing invariant checks and returning incorrect values for non-configurable array properties.
[JSC FTL] (UAF) a2de66f — Delays ensureStillAliveHere(base) in Array.indexOf/includes compilation until after GC-capable vmCall, fixing potential UAF where the base array could be collected mid-operation.
[WebCore XMLDocumentParser] (UAF) ba3be26 — Fixed a use-after-free in XML parser where custom element constructors can re-parent or adopt elements mid-parse, violating parserAppendChild invariants; added re-checks after reaction stack drains to prevent linking elements into multiple child lists.
[WebCore MediaSession] (UAF) d6fb60c — Fixed use-after-free in MediaMetadata artwork loader callback where lambda captured raw this pointer that could outlive the object after ArtworkImageLoader was exchanged. Changed to WeakPtr capture with null-check to prevent crashes.
[WebKit Blob registration] (Sandbox bypass) a18c0a8 — Tightened validation of replacementPath in blob registration to prevent arbitrary file deletion. A compromised web process could bypass sandbox checks by omitting the extension handle and later trigger FileSystem::deleteFile(). Now requires a valid sandbox extension for the path.
[WebCore graphics / PixelBuffer] (information disclosure) 0f85710 — Fixes uninitialized heap disclosure in GetPixelBuffer: non-RGB colorspace conversions could fail, returning stale heap bytes to callers. Adds RGB colorspace validation and zero-fill on error.
[WebKit UIProcess / back/forward list] (sandbox bypass) 9d4788b — Changed back/forward navigation validation from process-global to per-process basis, preventing a compromised WebContent process from forging file:// URLs in IPC messages to gain unauthorized file system access.
[JSC TypedArray] (OOB read) 7a9d149 — Fixes out-of-bounds read in TypedArray.from() when the map callback resizes or detaches the source ArrayBuffer, causing the loop to advance past the new bounds.
[WebKit IndexedDB] (validator bypass) e2b88c2 — Rejects IndexedDB transactions arriving during active version change operations to prevent a compromised WebContent process from bypassing client-side validation checks through forged IPC messages.
[JSC WASM JIT] (UAF) 20d1bae — Fixes UAF by unconditionally keeping OMGOSREntryCallee alive during callsite repatching in WASM re-tier path. Stale weak references could be freed concurrently during patching when a fresh BBQCallee replaces a retired one.
[WebGPU RenderPassEncoder] (OOB read) 543f99d — Fixed signed-negation overflow in baseVertex validation: INT32_MIN wrapped to itself, bypassing bounds checking and allowing OOB vertex buffer reads. Patch widens baseVertex to int64_t before negation.
[JSC Yarr JIT] (OOB read) bd5f1e5 — Fixed negativeOffsetIndexedAddress to use adjusted base register instead of original value, eliminating out-of-bounds reads in regex pattern matching via crafted Unicode strings.
[WebCore mediastream] (race condition UAF) e7f7480 — Fixed a data race on VideoFrameLibWebRTC::m_conversionCallback between clone() and pixelBuffer() causing use-after-free. Lock acquisition and thread annotations now synchronize callback access to prevent freed-callback dereference via WebCodecs API.
[JSC WebAssembly] (UAF) a012bab — Fixed use-after-free where GC could collect a WebAssembly.Memory while its wasm-originated ArrayBuffer was still performing resize operations, triggered via WebAssembly.Memory.toResizableBuffer() + GC pressure.
[WebCore Background Fetch] (UAF) bbd73ca — Fixed heap use-after-free in background fetch progress event handling: synchronous events fired during document iteration could be mutated by handlers, invalidating the iterator. Events now queued to fire after iteration.
[WebCore video frames] (heap disclosure) 7c03dc5 — GPU heap memory exposed via CVPixelBuffer padding when processing SharedVideoFrameInfo IPC with bytesPerRow=0; fixed by zeroing the unused buffer portion.
[WebCore SharedVideoFrameInfo] (Heap disclosure) 5d977a0 — WebProcess could craft IPC messages with bytesPerRow=0, triggering allocation of uninitialized CVPixelBuffer data that leaks GPUP heap memory. Memset of allocated buffer prevents the disclosure.
[WebCore animations] (UAF) 5c9eba9 — Fixed use-after-free in AnimationTimelinesController::suspendAnimations where m_timelines HashSet mutates during iteration when layout is triggered by applyPendingAcceleratedAnimations. Web-reachable via scroll-timeline and view-timeline CSS properties.
[WebCore AVFoundation CDM] (race condition) e5439f4 — Off-main-thread destructor raced with main-thread createSession() both mutating unlocked m_sessions Vector, causing heap corruption. Fixed by pinning destruction to main thread.
[WebCore MIME type cache] (race condition) 576ee4a — Fixed data race allowing use-after-free in MIME type validation via concurrent access to unprotected collections; affects media element type checking which is web-reachable.
[WebKit Network process] (sandbox bypass) 74d0c62 — Network process allowed temp-directory file reads via JS fetch() without sandbox extensions, a web-reachable sandbox bypass. Fixed by restricting for MobileSafari, but third-party apps retain the exemption pending proper sandbox-extension infrastructure.
[WebKit NetworkProcess] (sandbox bypass hardening) 442b80b — Enables blocking of local file loads without sandbox extension on macOS, preventing compromised WebContent from accessing protected files.
[JSC JIT] (exception confusion) f9e6d8b — Added throw scope to getByIdMegamorphic JIT operation; missing scope allowed execution past exceptions from user-defined getters, potentially enabling access to objects in inconsistent state.
[WebGPU Queue] (hardening) 81aff73 — Adds missing heightForMetal check to 1D texture write fast-path, preventing Metal replaceRegion from being called with zero-height dimensions from attacker-controlled WebGPU commands.
[bmalloc libpas] (OOB) 6cccd5e — Hardened libpas MAR registry against OOB read/write from attacker-controlled allocation records by validating frame counts and using bounds-checking accessor functions instead of direct array indexing.
[JSC bytecode] (OOB read) 449c42b — Fixes incorrect offset calculation when emitting Extension ExpressionInfo after MultiWide records; wrong offset fed to decoder could cause out-of-bounds read within the encoded-info buffer. Web-reachable via generator + eval with large padding.
[WebKit UIProcess] (UAF) 8ec0222 — WKMarketplaceKit completion handler could invoke addConsoleError() on a non-main thread, causing crashes when accessing main-thread-only objects. Wrapped the call with ensureOnMainRunLoop() to dispatch back to the main thread.
[JSC WASM IPInt] (Integer overflow) b44e37c — Changed m_pendingOffset from int32_t sentinel to std::optional and added overflow checks to metadata offset calculations, preventing integer overflow that could corrupt WASM branch target deltas.
[JSC watchpoint] (UAF) c98a8ac — Fixed UAF in AdaptiveValuePropertyInlineCacheClearingWatchpoint where fire() could dereference a GC-collected CodeBlock owner by adding missing isValid() override.
[bmalloc libpas] (race condition) 82b692f — Fixed a race condition in the medium-size directory lookup where the slow path incorrectly assumed the heap-lock was held. This allowed concurrent threads to receive allocations smaller than requested, causing heap corruption when writing beyond the actual slot size.
[JSC WASM] (validator bypass) 0f0de8f — Fixed WASM streaming compiler to reject modules mixing legacy and spec-compliant exception handling, ensuring consistency between streaming and non-streaming compilation paths.
[WebKit GPUProcess / graphics] (dangling reference) b63b114 — Rejects DynamicContentScalingDisplayList IPC via MESSAGE_CHECK when prepareBufferForDisplay is active, preventing destruction of in-use graphics context and resulting dangling reference.
[ANGLE Transform Feedback] (validator bypass) bec77c5 — ResumeTransformFeedback lacked validation ensuring the active program matched the transform feedback object's program, allowing out-of-spec state via WebGL. Fix adds validation to enforce this precondition.
[WebKit IPC] (Race condition) 267fa38 — Fixed data race on callback: sendMessageImpl() read/invoked outside lock while invalidate() cleared it without synchronization. Wrapped in Box<> to enable safe copying under lock.
[JSC Repatch] (race condition) 140ce5b — Added ConcurrentJSLocker guards to three IC repatch slow-path functions, fixing a data race between GC and concurrent JIT during megamorphic→generic transition.
[WebCore graphics ANGLE] (hardening) ce030f7 — PixelStorei now validates input parameters in ANGLE backend, accepting only UNPACK_* settings and rejecting others with InvalidOperation error.
[WebCore Filters] (Information disclosure) d3cffdd — Fixed uninitialized heap memory in FEGaussianBlur's temporary buffer when processing alpha-only images with asymmetric blur radius, which could disclose heap contents via SVG filters and canvas getImageData().
[WebCore JS bindings] (sentinel escape) 6ea1f0a — Empty JSValue sentinel leaked to JavaScript when IDL argument conversion failed in promise-pair operations; attacker-triggerable via navigation.navigate() with malicious toString(). Second promise was left unrejected.
[WebGPU BindGroupLayout] (validator bypass) aad3188 — Fixed stale WeakPtr comparison in bind group layout validation that could incorrectly permit incompatible explicit/destroyed-auto layout pairing, allowing invalid GPU resource bindings to reach downstream execution.
[ANGLE Metal renderer] (OOB read) 8d4c709 — Fixed offset and count mismatches in ANGLE Metal DrawElements pipeline stages that could cause out-of-bounds reads when incorrect offsets were applied to pool-allocated intermediate buffers.
[JSC DFG] (type confusion) 0d6fe16 — Fixes DFG abstract interpreter's structure prediction for spread operator, which omitted cellButterflyOnlyAtomStringsStructure. Incomplete prediction could weaken speculation guards in JIT code, allowing incorrect type assumptions.
[WebCore filters] (uninitialized memory) bb98ffd — Pixel buffer copy failures returned uninitialized heap contents via CSS filter effects; fix validates copy and returns null on failure.
[WebKit UIProcess WebsiteDataStore] (UAF) e1084c3 — Fixed use-after-free in app-bound domain checking where an async lambda captured host and protocol strings by reference; when the lambda fired asynchronously after the function returned, it accessed dangling references.
[WebCore Storage Access] (gesture bypass) d8576e6 — Fixed synthesized user gesture in requestStorageAccess() rejection handler, which allowed cross-site iframes to invoke gesture-gated APIs without user interaction.
[JSC DFG] (Lifetime fix) c3ca56b — Fixed node scan range bug in DFGArgumentsEliminationPhase where reusing a loop variable across multiple inline call frames caused nodes to be scanned in wrong ranges, allowing in-use heap-allocated arguments to be incorrectly eliminated.
[WebGPU] (validator bypass) 67b563b — Fixed origin-clean validation bypass in importExternalTexture where cache hits skipped cross-origin checks, allowing reads of cross-origin video data without CORS.
[WebKit NetworkStorageManager] (hardening) 937bbd7 — Adds MESSAGE_CHECK to putOrAdd handler to reject IDBKeyData with std::nullptr_t or Invalid variants, preventing Network process crashes when a compromised WebContent process sends malformed keys.
[WebCore EventRegion] (UAF) eaa2b44 — Fixed heap-use-after-free in EventRegionContext::shrinkWrapInteractionRegions where a reference to a vector element remained dangling after m_interactionRegions.insert() triggered reallocation; patch stores the original index and re-fetches from the vector instead.
[WebGPU BindGroup] (validator bypass) 57ae126 — Rejects duplicate binding entries in WebGPU bind group descriptors. Duplicate entries previously caused dynamic-offset validation in setBindGroup to diverge from offsets applied at dispatch, potentially enabling OOB GPU buffer access.
[WebCore graphics / PathCG] (race condition) 95f9f59 — Fixed unsynchronized access to a global CGContextRef in PathCG::strokeContains(), where concurrent OffscreenCanvas worker calls to isPointInStroke() could race and corrupt shared graphics context state.
[WebCore async-clipboard] (SOP bypass) 73645ab — Cross-origin iframes bypassed clipboard SOP by receiving the top-level page's UserGestureToken via postMessage, enabling unprompted read/write. Fixed by requiring transient activation on the global object, which doesn't propagate cross-origin.
[WebKit Extensions / Declarative Net Request] (UAF) ea3fbf9 — Replaced unsafe static NSArray initialization with dispatch_once to guard against concurrent access during declarativeNetRequest rule compilation, preventing use-after-free in the UI Process.
[bmalloc libpas] (information disclosure) dce31d0 — Zeroed allocator returned uninitialized heap memory when MAR logging was active, disclosing stale heap contents instead of cleared allocations.
[ANGLE MSL compiler] (validator bypass) 6d057b7 — Fixed missing infinite-loop detection for nested loop initializers/expressions and unhandled expression patterns in ANGLE's MSL compiler; crafted WebGL shaders could bypass the check, causing GPU hangs or driver-level issues.
[WebKit NetworkProcess IPC] (hardening) a90c33d — Gated CacheStorageRepresentation IPC endpoint behind AllowTestOnlyIPC; closes a test-only NetworkProcess handler that was previously accessible from production web content.
[JSC / WasmGC] (hardening) 736ce62 — Disallows private field and method installation on WasmGC objects to preserve their fixed-layout invariant; aligns with V8 and SpiderMonkey to maintain type system integrity.
[WebCore loader] (timing oracle) d7c0b5a — Added delayed timer for synthetic load event when cross-origin parent navigates same-document iframe, eliminating timing oracle that allowed attackers to guess iframe URL by observing immediate load event.
[WebKit NetworkProcess] (access restriction) e66a3f3 — Refined Networking process sandbox restrictions: changed blocked-paths list from parent temp directory to only the temp folder, allowing legitimate uploads while maintaining sandbox protections.
[WebKit NetworkSessionCocoa] (privacy bypass) 971435f — WebSocket requests on Cocoa could skip cookie partitioning policy enforcement when mutableRequest was nil, allowing unpartitioned cookies to leak across site boundaries under opt-in partitioning. Fixed by ensuring mutableRequest is initialized.
[WebCore FEMorphology filter] (off-by-one) d97d1af — Fixed off-by-one in FEMorphology filter's parallel job stitching that used the current job's height instead of the previous job's height to advance the destination y-offset, causing scratch buffer rows to be written at incorrect positions in the destination pixel buffer during SVG filter rendering.
[bugs.webkit.org Commits] (Stored XSS) f9eddca — Unescaped captured commit identifiers in Commits extension were interpolated into link HTML, enabling stored XSS. Fixed by applying html_quote to captured groups and narrowing regex matchers to valid commit identifiers.
[JSC Yarr] (O(N²) DoS) 0012e61 — Caps Yarr regex JIT code generation at 16 MB to prevent DoS via patterns with repeated non-greedy groups causing O(N²) code emission; falls back to interpreter above limit.
[WebCore MediaSource mock] (hardening) 82a21e0 — Changed timeScale and duration from signed to unsigned integers in MockSampleBox, preventing negative values that could cause incorrect time calculations.
[WKBackForwardList test] a27bc97 — Build fix: removed errant formatting characters from a test validating that forged file:// URLs are rejected in back-forward list validation.
[WebCore animation] (unresolved-offset) 699f1ca — Fixed crash when keyframes with view-timeline-range keywords are applied to animations using plain scroll timelines; now properly resolves computed offsets during AcceleratedEffect creation.
[WebCore WebXR] (UAF) 1d46772 — Use-after-free in WebXR when XRSession calls end() after its cross-realm iframe's WebXRSystem is garbage collected; fixed with WeakPtr adoption and null checks.
[PrettyPatch] (XSS) 9bb8fdf — Fixed XSS in binary image diff rendering by HTML-escaping image URLs, preventing injection of malicious markup into bugs.webkit.org.
[WebCore animation] (hardening) 06319c3 — Fixed a crash in accelerated animation transforms when a keyframe has a NaN offset. Returns false early to avoid attempting style resolution with non-computed offsets.