This Week in WebKit — April 27 - May 3, 2026
Featured
No memory corruption anywhere — the capability itself is the bug. A compromised renderer writes httpOnly cookies for any origin, including ones the site's own script could never set.
Three UIProcess paths handed a compromised renderer's bytes to whatever parser ImageIO picked. No memory-safety bug here — only the surface where one would be worth the most.
Three families of alternate spelling reached the file-URL slot anyway. A compromised renderer picks the path; a user paste into the wrong app does the rest.
Crafted CSS with a positional :has() argument is the whole prerequisite. Element removal never purged the cache — and something later commits what it kept.
A compromised renderer can trip this one and survive it, but only inside the process-swap window a cross-site navigation opens. The check itself was never wrong.
str.codePointAt(i) === undefined folds to a constant on the strength of an exit the optimiser then deletes. Out-of-range indices stop deoptimising.
Security fixes
- Iterator invalidation in `Page::forEachPage` and its sibling walkers
- Tracker lookup tables raced between the WebPrivacy and resolver threads
- `OpaqueJSClass` stores `parentClass` without retaining it
Notable development
-
Enable `SiteIsolationSharedProcessEnabled` by default
feature WebKit UIProcess Site Isolation
-
Report the restored document's identity on back/forward cache commit
bug WebCore Frame Loading
-
Move memory-footprint sampling to a UIProcess `MemoryFootprintMonitor`
hardening WebKit UIProcess
-
Auto-generate catch-and-default-reply wrappers for Swift IPC receivers
refactor WebKit IPC Infrastructure
-
[JSC] Redesign WeakGCSet to match WeakGCMap
refactor JavaScriptCore Heap
-
[JSC] Unify JS Allocators
optimization JavaScriptCore Heap
-
Add the notification delegate API surface for the browser.notifications web extension API
feature WebKit Web Extensions
Other security-relevant changes
- [JSC Wasm] (race condition, UAF)
b9d4779— Adds cross-modifying-code fence to finalizeWasmCalleeCleanup to ensure the current thread observes all patched callsites, preventing stale invocation of freed BBQCallees. Theoretical issue; untested. - [WebKit Mac accessibility] (UAF)
430a7b5— Accessibility wrapper returned as raw pointer was freed when its last strong reference (AXIsolatedTree) went out of scope, before AppKit could retain it. Fix wraps the wrapper in RetainPtr::autorelease() to extend its lifetime. - [WebKit UIProcess speech recognition] (hardening)
49e046b— Added bounds validation for numberOfFrames in speech recognition IPC handler, preventing untrusted WebContent from triggering unbounded audio buffer allocation in the privileged UI process. - [WebCore WebGL] (incorrect state)
b871911— Fixes premultiplication-status handling regression in WebGL texture uploads by resolving the status at the call site instead of during framework initialization. - [WebKit NetworkProcess / WebSocket] (same-site bypass)
c876f70— WebSocket tasks never set _siteForCookies, so CFNetwork attached all matching cookies regardless of SameSite attribute. Fix calls updateTaskWithFirstPartyForSameSiteCookies() on WebSocket tasks at creation, restoring same-site cookie filtering and CSRF protections. - [WebCore ControlFactory] (hardening)
9289509— Fixed GPU process crash from destroying ControlFactoryMac's cached AppKit NSCell instances off the main thread when the owning RemoteGraphicsContext was destroyed on a work queue. Ensured ControlFactory destruction runs on the main run loop to prevent thread-unsafe deallocation. - [WebCore FloatingObjects] (stale state)
5de3fda— Removes stale floats from the suspended list when discarding line content, preventing double-positioning. Adds placeFloatingBox() to properly re-key the spatial tree when updating a float's position. - [WebKit NetworkProcess WebTransport] (proxy bypass)
d7912bc— WebTransport connections weren't marked with application identifiers or tracker status, preventing correct routing—connections that should be proxied could go direct. Patch reuses WebRTC helpers with new IsRTC parameter to gate RTC-specific behavior.