◆ WebKit WeeklyBeta
← All reports
16 picks from 462 commits
2026-08-29 – 09-04

This Week in WebKit — August 30 - September 5, 2026

462
Total commits
27
Security fixes
1 Critical, 2 High, 3 Medium in deep-dive; 21 additional security-relevant changes
102
Contributors
Top components WebCore · WebKit · JSC · Other · Platform

Featured

Security · Critical
Constant folding deleted the one check the rest of the compile had already spent

The branch the optimizer proved dead runs anyway, with no exit left to catch it. What comes back to script is a 64-bit pattern of your choosing, typed as a cell.

→ ObjectCreate constant fold drops its prototype speculation JSC DFG JITTypeConfusion
Security · High
A number crossed the IPC boundary and came back out as a pointer

From a compromised renderer, the GPU process can be told to read any address into a texture — and textures are readable. The check that made that safe lived in code WebKit doesn't own.

→ Untrusted texture-upload offset reinterpreted as a client pointer WebCore GraphicsContextGLOOB
Security · High
The filter ran first, then the worklist quietly put the candidates back

A safety check that isn't the last word isn't a safety check. The payoff, in inlined closure and varargs frames, is a GC stack walk reading slots other code already reused.

→ Allocation sinking re-adds candidates the inline-frame check demoted JSC DFG JITTypeConfusion
Security · Medium
Teardown asked a boolean whether it was registered; the map said otherwise

A freed proxy stays in the source's frame-observer map, and the capture thread dispatches through it. Reaching it needs raw capture IPC and a second proxy keeping the source alive.

→ Stale video-frame observer survives capture-proxy destruction WebKit GPU media captureUAF
Development · bug
Three decoders, three codec libraries, one out-of-bounds write

AVIF, WebP and JPEG XL got the same thing wrong independently, and one <img> on GTK or WPE is the whole trigger. The shared assumption is the interesting part.

→ OOB writes in the non-Cocoa AVIF, WebP, and JPEG XL decoders WebCore image decoders
Development · bug
The scheme the app opted into CORS never got a CORS check

Cross-origin content in a WKWebView could read an app's custom-scheme resources through an ordinary no-cors request. The opt-in was real; the enforcement wasn't where it needed to be.

→ CORS enforcement for app-registered custom URL schemes WebKit custom URL schemes

Security fixes

Notable development

Other security-relevant changes

  • [WebGPU CommandBuffer] (race condition, UAF) 95c3cfc — CommandBuffer destructors ran on Metal completion thread instead of work queue during teardown, causing torn refcount in CommandEncoder and racing Device::m_commandEncoderMap. Leads to UAF in GPU process reachable from WebContent WebGPU API.
  • [WebCore AcceleratedEffect shapes] (UAF, race condition) 7224709 — Fixed cross-thread use-after-free in AcceleratedEffect path caching by synchronizing access to a static TinyLRUCache with locks and returning Path by value instead of by reference, preventing double-free when CSS offset-path animations race main and scrolling threads.
  • [JSC B3 ccmp matcher] (miscompilation) 65ef7f3 — Stale matcher state from failed ccmp-chain pattern matches was miscompiling nested comparison expressions. Fixed with RAII-based rollback to clean up partial state on failure.
  • [WebGPU] (UAF) d4a150e — Fixed race window in WebGPU writeTexture/writeBuffer where buffers could be freed before GPU consumption completed, leading to use-after-free reads. Fix retains buffer storage via completion callbacks until GPU work finishes.
  • [JSC CodeBlock] (watchpoint invalidation) e6507c8 — Pre-invalidates watchpoints for captured variables in generator/async functions, preventing unsafe constant-folding when the CodeBlock is recreated during suspension.
  • [WebKit GPU media decoder] (TOCTOU) 8db7ec0 — Fixed TOCTOU race in GPU process image decoder: unsafeBuffer() allowed WebContent process to mutate shared memory during decode; now copies data via SharedBuffer::create() before use.
  • [ANGLE VertexArray] (OOB read) e521d4c — Fixed element limit cache not being updated when vertex attribute format changes, allowing out-of-bounds buffer access that validation should have prevented.
  • [WebCore IOSurfacePool] (OOB read) b23dfbc — Fixed out-of-bounds read in IOSurfacePool eviction when HashMap-Vector desynchronization causes end() iterator dereference, allowing takeLast() to read adjacent heap memory.
  • [WebCore ShareDataReader] (UAF) 0bcd5c8 — Fixed use-after-free where ShareDataReader captured raw this in completion handler; object could be freed mid-callback. Now captures weakThis and converts to RefPtr, keeping the reader alive through didFinishLoading.
  • [WebRTC H264/H265 encoder] (OOB read) 141ea15 — Fixed an out-of-bounds read in H264/H265 video encoding where AppendData used the total CMBlockBuffer size instead of chunk length, copying out-of-bounds heap data into the encoded frame buffer.
  • [GPU Process RemoteRenderingBackend] (data leak) 1d12ff7 — Releases GraphicsContext when transferring ImageBuffer between RemoteRenderingBackend instances, preventing leak of non-thread-safe cross-backend state through retained context references.
  • [GPU process RemoteImageBuffer] (heap disclosure) feef6b1 — Rejected getPixelBuffer/putPixelBuffer IPC calls on LayerBacking image buffers and zero-filled uninitialized destination buffers, preventing WebContent from leaking uninitialized GPU-process heap memory via forged calls.
  • [WebKit NetworkProcess] (validator bypass) f7540ca — Relands IPC validation of several ITP and storage access messages, and swaps the LogUserInteraction MESSAGE_CHECK for an early return, avoiding WebContent process termination while still blocking forged domain access.
  • [JSC YarrJIT] (OOB read) 8f069ce — Fixed YarrJIT non-BMP backtrack trampoline that omitted firstCharacterAdditionalReadSize adjustment, producing inverted match bounds (start > end) and matches extending past the subject. The missing index register adjustment was added and a RELEASE_ASSERT was introduced.
  • [JSC Wasm GC] (hardening) ace1903 — Fixed Wasm GC br_on_cast/br_on_cast_fail instructions to handle overlong LEB128 encodings correctly. Attacker-crafted modules could previously desync validator-computed allowNull checks from runtime, bypassing type soundness via misaligned flag byte reads.
  • [WebGPU indirect draw] (OOB vertex fetch) 43ed70e — Adds regression test for WebGPU drawIndirect vulnerability where a finished-but-never-submitted encoder could poison the clamping cache and enable out-of-bounds vertex fetches. The upstream fix is absent — dropped as obsolete since 319317@main removed the cache mechanism.
  • [WebGPU Buffer] (OOB read) ff78e4f — Tracked maximum ever-written index instead of highest validated index in WebGPU index buffers, allowing a large writeBuffer call to poison validation state for subsequent writes and trigger GPU out-of-bounds reads.
  • [UIProcess RemoteLayerTree DisplayLink] (UAF, re-entrancy) b0d927d — Re-introduced a guard that prevents re-registering a DisplayLink client during re-entrant teardown, which could leave the client freed but still invoked by the next CVDisplayLink callback.
  • [UIProcess RemoteLayerTree] (race condition UAF) e25bd0f — Fixed a race condition in which the scrolling thread could access a freed m_momentumEventDispatcher after the main thread nullified it; all accesses are now protected by a lock.
  • [WebCore Document] (validator bypass) 49cbb80 — Fixed case-sensitive comparison in Document::execCommand that allowed differently-cased command variants (e.g., 'InsertHTML') to bypass Trusted Types CSP enforcement, enabling untrusted HTML injection.
  • [WebCore CSP] (nonce theft) 62a36ef — Fixed nonce-based CSP bypass where dangling markup could cause nonced elements to have injected attribute names/values containing '<link' strings. Element::isNonceable() now checks for '<link' in attribute names and values to detect injection patterns, alongside existing '<script' and '<style' checks.
Generated with prompt v1.9.0