This Week in WebKit — July 11 - July 17, 2026
488
Total commits
3
Security fixes
High 1건, Medium 1건, Low 1건
109
Contributors
Top components
WebCore · WebKit · JSC · Platform · Other
Featured
Security · High
The JIT proved a broad type and treated it as proof of the exact one.
Hand it the wrong iterator and its fields read as regexp pointers — from ordinary script. The surprising part is why the JIT thought the check was already done.
Security · Medium
A lock refactor let a shared object's last reference escape the lock.
The escaping release lands in a cross-thread teardown race; win it and shared IPC state frees under two threads. Why it escaped is pure C++ scope order.
Development · hardening
The privileged process trusted the sandbox to say the user tapped.
A compromised renderer could raise a native credential picker with no real gesture behind it. And one true tap opened more pickers than one.
Security fixes
-
WebSpeechSynthesisWrapper missing observer deregistration
Low WebCore platform speech synthesis (Cocoa)