◆ WebKit WeeklyBeta
← All issues

This Week in WebKit — July 04 - July 10, 2026

447
Total commits
8
Security fixes
5 High, 1 Medium deep-dived; 2 additional hardening changes
113
Contributors
Top components WebCore · Other · WebKit · Platform · JSC

Featured

Security · High
The decode endpoint that checked a URL was valid — and nothing else.

A compromised renderer could name a file:// path or borrow a victim's cookie first-party. The NetworkProcess trusted both — the question is how far the loader carries them.

→ LoadImageForDecoding scheme and cookie-access validation WebKit NetworkProcess IPC
Security · High
Two text paths shared a cache — only one remembered to hold on.

A weak-pointer glyph cache trusted every producer to keep its own fonts alive. The complex-script path didn't, and a font purge does the rest.

→ Complex text path retains system fallback fonts WebCore font rendering
Security · High
The destructor cleaned up the back-pointer. The reset paths forgot.

Only the destructor ever cleared a raw back-pointer — but a script-held animVal can outlive its owner, and the destructor never runs. Then a value read walks freed memory.

→ SVGProperty animVal detach after stopAnimation WebCore SVG property model
Security · High
Per-context isolation held everywhere — except one nested replay edge.

The GPU process moved control rendering off a shared singleton to keep its threads apart. A display list nested inside a display list quietly reached back for it.

→ Nested DrawDisplayList replay ControlFactory confinement WebCore Display List replay (GPU process)
Security · High
The GPU audio handler assumed a renderer would only ever ask once.

A duplicate CreateAudioSourceProvider overwrites callbacks a real-time audio thread is still running. Whose reference gets dropped mid-use?

→ RemoteMediaPlayerProxy rejects duplicate CreateAudioSourceProvider WebKit GPU Process media IPC

Security fixes

Other security-relevant changes

  • [WebKit Networking] (hardening) cf2d405 — Hardens validation in loadImageForDecoding by sourcing firstPartyForCookies from authoritative mainFrameURL instead of client-controlled state, preventing network process crashes when called before navigation or with invalid mainDocumentURL.
  • [Websites / PrettyPatch] (hardening) dcb203f — Added base85 decoder and 50MB size limit to PrettyPatch for handling git binary image diffs; hardens patch display on bugs.webkit.org tooling.