◆ WebKit WeeklyBeta
← All issues

This Week in WebKit — July 04 - July 10, 2026

447
Total commits
8
Security fixes
5 High, 1 Medium deep-dived; 2 additional hardening changes
113
Contributors
Top components WebCore · Other · WebKit · Platform · JSC

Featured

Security · High
The decode endpoint that checked a URL was valid — and nothing else.

A compromised renderer could name a file:// path or borrow a victim's cookie first-party. The NetworkProcess trusted both — the question is how far the loader carries them.

→ LoadImageForDecoding scheme and cookie-access validation WebKit NetworkProcess IPC
Security · High
Two text paths shared a cache — only one remembered to hold on.

A weak-pointer glyph cache trusted every producer to keep its own fonts alive. The complex-script path didn't, and a font purge does the rest.

→ Complex text path에서 system fallback font가 유지되지 않는 문제 WebCore font rendering
Security · High
The destructor cleaned up the back-pointer. The reset paths forgot.

Only the destructor ever cleared a raw back-pointer — but a script-held animVal can outlive its owner, and the destructor never runs. Then a value read walks freed memory.

→ SVGProperty animVal detach after stopAnimation WebCore SVG property model
Security · High
Per-context isolation held everywhere — except one nested replay edge.

The GPU process moved control rendering off a shared singleton to keep its threads apart. A display list nested inside a display list quietly reached back for it.

→ Nested DrawDisplayList replay ControlFactory confinement WebCore Display List replay (GPU process)
Security · High
The GPU audio handler assumed a renderer would only ever ask once.

A duplicate CreateAudioSourceProvider overwrites callbacks a real-time audio thread is still running. Whose reference gets dropped mid-use?

→ RemoteMediaPlayerProxy rejects duplicate CreateAudioSourceProvider WebKit GPU Process media IPC

Security fixes

Other security-relevant changes

  • [WebKit Networking] (hardening) cf2d405 — loadImageForDecoding의 validation이 강화되었습니다. Client가 제어할 수 있는 상태 대신 신뢰 가능한 mainFrameURL에서 firstPartyForCookies를 가져오도록 변경되었습니다. 이를 통해 navigation 이전에 호출되거나 mainDocumentURL이 유효하지 않은 상태로 호출될 때 network process가 crash하는 상황을 방지합니다.
  • [Websites / PrettyPatch] (hardening) dcb203f — git binary image diff를 처리하기 위해 PrettyPatch에 base85 디코더와 50MB 크기 제한이 추가되었습니다. bugs.webkit.org 도구에서 patch를 표시하는 과정의 안정성을 강화합니다.