← WebKit Silent-Fix Report — 2026-W22
8449fc1aac Fix encodeHostName() for inputs containing %
severity low
class Bypass
confidence 0.45
WTF URL/IDN
Primitive: host IDN decoding skipped due to wrong variable check
Triage note: Corrects a check that used an unset string so percent-encoded hosts skipped IDN mapping, a possible spoofing vector.
Triage note: Corrects a check that used an unset string so percent-encoded hosts skipped IDN mapping, a possible spoofing vector.
Security-relevant, below the exploitable-grade bar for a full root-cause writeup. The triage verdict is above; the side-by-side patch is below.
Before / after
Loading diff…