This Week in WebKit
Featured
Any page can drop the speech object and have a deferred main-thread callback dispatch through freed memory. Something in that callback was protected — just not the object it calls into.
A compromised WebContent process can slip a file:// URL past the one check written to stop it. The gap arrived with the patch that added that check.
A page driving WebGPU can tear down the connection mid-completion and leave two threads decrementing one non-atomic refcount. The outer object was thread-safe.
A content process only has to send an audio-hardware message to make the UI process dispatch into a client that is already gone. No client owns the cache that kept it alive.
Validation covered zero and nothing above it; script-chosen dimensions reached a third-party encoder untouched. The new bound is 32767, which is its own tell.
A guard that is never bypassed can still stop covering the access behind it. The index register the load actually used was defined by nothing at all.
Security fixes
Notable development
-
Local Network Access check lands in NetworkProcess
feature WebKit NetworkProcess / Local Network Access
-
Documents finally get their own IP address space
feature WebCore Loader / Local Network Access
-
Backend handoff reworked for remote ImageBuffers
optimization WebKit GPU Process / Remote Rendering
-
Integer underflow in the OpenType VORG table size computation
hardening WebCore Font Parsing
-
IsoSubspaces share a single default aligned-memory allocator
optimization JavaScriptCore Heap
-
RegExpTestInline extends to quantifiers, alternation, and unicode flags
optimization JavaScriptCore DFG/FTL JIT
-
Swift IPC receivers get a throwing MESSAGE_CHECK
hardening WebKit IPC / UIProcess
-
[GPUProcess] Move the drawing Font functionalities to a new class named FontBase
refactor WebCore Graphics / GPU Process
Other security-relevant changes
- [WebKit UIProcess / clipboard access] (IPC validation bypass)
173261c— Hardens clipboard access by independently validating frame transient activation in UIProcess instead of trusting WebContent process claims; prevents a compromised WebContent process from fabricating activation claims to bypass clipboard read restrictions. - [WebCore SVG animation] (unsigned integer overflow)
28da9c5— Hardens SVGSMILElement repeat-count calculation by clamping to prevent overflow, and coalesces repeat events during seeks to avoid unbounded iteration; fixes crashes when seeking with indefinite repeatCount. - [WebCore loader] (popunder)
a37a650— Fixed popunder bypass by requiring transient activation on the opener before focusing an existing named window, preventing popups from re-triggering focus via overlapping user activations. - [WebCore WebAuthn] (OOB read)
79d7541— Fixed cross-container iterator reuse in CBOR WebAuthn extension parser; iterator was compared against wrong container's end(), causing out-of-bounds dereference when credProps lacks 'rk' key.