◆ WebKit WeeklyBeta
← All issues

This Week in WebKit — June 27 - July 03, 2026

557
전체 commit 수
151건
보안 수정
심층 분석 6건: High 5건, Medium 1건; 145건은 부록 수록
109명
기여자
Top components WebCore · WebKit · Platform · JSC · Other

Featured

Security · High
navigation.navigate() with no arguments hands JavaScript a raw Exception cell

The bindings knew one shape of failure and missed another. What comes back isn't a JSObject — and the very next property store treats it like one.

→ Type confusion via raw Exception cell returned to script from callPromisePairFunction WebCore JS bindings
Security · High
The audio buffer that stayed detachable until you pressed play

Two earlier fixes pinned the backing store — but only once playback started. Set the buffer first and it's still yours to free.

→ Use-after-free in AudioBufferSourceNode via detached ArrayBuffer backing store WebCore Web Audio
Security · High
The observer loop that kept every client alive — but not registered

Snapshotting clients into strong refs keeps them alive — so the loop looks safe. Alive isn't the same as still registered, and one callback can sever the difference.

→ Use-after-free in CSSFontFace::setStatus via CSSFontFace::load WebCore CSS font loading
Development · bug
A cross-origin iframe was handed a live pointer to its parent's DOM

sourceElement assumed both frames share an origin. Dispatched into a cross-origin child, its ownerDocument walks straight into the parent — no prompt, no gesture.

→ Cross-origin parent DOM exposed via NavigateEvent.sourceElement

Security fixes

Notable development