← WebKit Silent-Fix Report — 2026-W22

8449fc1aac  Fix encodeHostName() for inputs containing %

severity low class Bypass confidence 0.45 WTF URL/IDN
Anne van Kesteren Fri May 29 13:24:25 2026 -0700 full: 8449fc1aaccab18301e786f3e337b8e5540cd99e bug report ↗ view on GitHub ↗
Primitive: host IDN decoding skipped due to wrong variable check
Triage note: Corrects a check that used an unset string so percent-encoded hosts skipped IDN mapping, a possible spoofing vector.

Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.

Before / after

Loading diff…