PatchGap

WebKit Silent-Fix Report — 2026-W25

Window: 2026-06-15 - 2026-06-21 (ISO 2026-W25). Generated by the webkitMon commit hunter (structural scorer v2 → LLM triage → root-cause analysis).

Coverage

  • 264 commits triaged (floor-0 candidate set: every commit scoring ≥0).
  • 60 judged security-relevant; 40 exploitable-grade (isSecurity, confidence ≥0.6, severity high/medium) with full writeups.
  • Non-security in candidate set: 204 (candidate-set false-positive rate 77%).

Columns. Sev — severity (high / medium / low / dev). Conf — the triage model’s confidence (0.00–1.00) that the commit is a genuine security fix. Class — bug class (UAF, OOB, type confusion, race, cross-origin, bypass, …). Every row links to a full page with commit metadata and a side-by-side before/after view; the exploitable-grade commits also carry a full root-cause analysis, PoC, and detection guidance.

Exploitable-grade picks

# Sev Conf Class Component Commit One-liner
1 high 0.85 TypeConfusion WebCore WebRTC RTCEncodedStreamProducer 8384c8455e Type confusion in RTCEncodedStreamProducer lets an audio frame be written as a video frame (and vice versa) causing OOB read
2 high 0.85 IntOverflow ANGLE / WebGL 56c55ddc38 ANGLE IndexRange integer overflow bypasses vertex index validation allowing out-of-bounds vertex access
3 high 0.85 OOB JSC YARR JIT 116394de19 Yarr JIT word-boundary assertion with unicode+surrogate corrupts firstCharacterAdditionalReadSize/index, producing a corrupted JSString
4 high 0.85 Bypass WebKit UIProcess Pasteboard 0d3713dbb6 getPasteboardPathnamesForType checked canAccessPasteboardTypes instead of canAccessPasteboardData, letting a web process read local file paths without data access
5 high 0.82 OOB WebKit GPU Process filters (FEColorMatrix) b5b06c0fc2 Validate FEColorMatrix values vector length before decoding in GPU Process to stop web-process-supplied mismatch causing OOB
6 high 0.82 CrossOrigin WebKit Site Isolation / WebPasteboardProxy 69aa56247c WebPasteboardProxy WriteWebArchiveToPasteBoard now rejects remote frame IDs not descended from the requesting root frame
7 high 0.80 CrossOrigin WebKit WebAuthn IPC 315ac3073a Add IPC message-check of security origin during WebAuthn GetAssertion so a compromised web process can’t spoof origin
8 high 0.80 SandboxEscape WebKit UIProcess pasteboard/attachments c6cd4e07e9 Validate/allowlist incoming file paths from the web process for attachment elements via addAllowedAttachmentFilePath
9 high 0.72 TypeConfusion JSC DFG ae69ef2312 DFG ArrayIterator entries path emitted GetByVal on Double array then NewArray with no ExitOK, letting Fixup misorder ValueRep conversion
10 high 0.72 OOB WebCore WebGL d0000cab59 WebGL readPixels to a PBO with an offset crashed; adds validation of PBO offsets (INVALID_OPERATION/INVALID_VALUE) to prevent OOB
11 medium 0.82 UAF JSC Wasm StreamingCompiler acee67e9af Fix UAF of StreamingCompiler::m_ticket by holding a smart handle and bailing via takeTicketIfActive() instead of raw exchange
12 medium 0.80 UAF WebCore DOM bindings (JSAttr GC) 8d71b72447 JSAttr GC visit of Attr’s owner element now takes a lock and uses CheckedPtr to avoid UAF/race with main-thread detach
13 medium 0.80 UAF WebCore HTML HTMLDialogElement 70753442a3 Copy invoker value into a local String before dialog close so a beforetoggle handler removing the value can’t cause UAF
14 medium 0.78 UAF JSC Wasm CalleeGroup 9a16de46f2 Keep BBQCallee (and edge-case OMGOSREntryCallee) alive across callsite collection and repatch to avoid UAF from wasm-thread frees
15 medium 0.75 Race WebCore bindings JSSubscriber GC db743cc339 Consolidate JSSubscriber GC visiting under m_teardownsLock and avoid refing on the GC thread to fix a race
16 medium 0.75 UAF JSC inline cache AccessCase GC 055680a255 Track customSlotBase for CustomAccessorGetter/Setter in forEachDependentCell so GC keeps it alive
17 medium 0.75 OOB WebCore editing ICUSearcher 03015890a6 isWordStartMatch clamps the word-boundary search index to the trimmed context buffer length, preventing an out-of-bounds read
18 medium 0.72 CrossOrigin WebKit Site Isolation 874b112868 Storage access wasn’t revoked when an iframe navigated itself cross-origin; now revoked when requester frame changes origin
19 medium 0.70 UAF WebKit GPU Process RemoteAudioVideoRendererProxyManager a7ea563d0f Use ThreadSafeWeakPtr (and expose controlBlock) for renderer callbacks to fix a crash in RemoteAudioVideoRendererProxyManager::ref
20 medium 0.70 OOB WebCore CSSOM 44ba2b5c11 Fix script-triggerable crash inserting @namespace after @import via CSSOM caused by global vs namespace-vector index mismatch
21 medium 0.70 UAF WebKit iOS fullscreen controller 4d4fbca02b Fix fullscreen crash by retaining self and windows (retainPtr) in animation/completion blocks instead of raw or weak captures
22 medium 0.70 Other WebKit WebExtensions image loading b9c7a1bf56 Restrict WebExtension icon decoding to web-supported image types so untrusted data can’t reach arbitrary ImageIO codecs
23 medium 0.70 SandboxEscape WebKit GPU RemoteMediaPlayerManagerProxy 446481a1be GPU process CreateMediaPlayer failed to reject contained media engines under MediaContainmentEnabled; adds MESSAGE_CHECK to terminate rogue WebContent
24 medium 0.65 IntOverflow JSC DFG 5e2667f6b1 Propagate observed baseline Int32 overflow into DFG via NodeMayOverflowInt32InBaseline
25 medium 0.65 Bypass WebCore CSP / CachedResourceLoader 150a3a12e5 Apply connect-src (not script-src) to JSON module imports so CSP enforces the correct directive
26 medium 0.65 TypeConfusion JSC LiteralParser aa5589433c LiteralParser takes the slow path when a proto setter mutates the original structure mid-parse, avoiding use of a stale transition offset
27 medium 0.62 IntOverflow WebKit UIProcess BackForwardList 37310f2c57 Swift BackForwardList rejects INT32_MIN and uses addingReportingOverflow for currentIndex+delta from web-process-supplied delta
28 medium 0.62 Race WebCore SVG filters f076e1adb5 FEMorphologySoftwareApplier made thread-safe (removed from uncounted-member expectations, parallel applier)
29 medium 0.60 UAF WebCore bindings DOMWrapperWorld d2af128b14 Adds sampled guard-page (mmap+mprotect) protection around DOMWrapperWorld m_wrappers table to catch UAF/corruption on rehash
30 medium 0.60 Bypass WebCore CSP 01c89d15c3 Fix CSP ‘self’ to match in opaque-origin http(s) (sandboxed/redirected) documents
31 medium 0.60 CrossOrigin WebCore SVG/CSS filters tainting 3e90b93505 Taint filter output when flood-color/lighting-color resolves to currentColor to avoid leaking computed color
32 medium 0.60 TypeConfusion WebCore HTML HTMLSelectElement 810f13a41f Fix crash when adding multiple attribute to appearance:base <select> while the renderer is still the generic (non-RenderListBox) one
33 medium 0.60 IntOverflow JSC LLInt/Baseline/DFG f7026fa96b Profile op_unsigned overflow in LLInt/Baseline and feed NodeMayOverflowInt32InBaseline in DFG for UInt32ToNumber
34 medium 0.60 OOB JSC array profiling / JIT 72e0ec4b21 Set ArrayProfile MayStoreHole appropriately on hole-creating stores so the JIT speculates array stores soundly
35 medium 0.60 OOB WebCore WebAuthn CBOR 97990a2481 AuthenticationExtensionsClientOutputs::fromCBOR compared a nested-map iterator against the outer map’s end(), undefined behavior
36 medium 0.60 Bypass WebCore SecurityOrigin/cache 20790ef5e0 Ref<SecurityOrigin> silently used pointer hashing, so Clear-Site-Data: cache failed to evict BFCache/MemoryCache entries; now a hard compile error
37 medium 0.60 OOB WebKit Geolocation b425ed981e WebGeolocationManager::resetPermissions had an inverted end() check, dereferencing the end iterator when the domain was absent
38 medium 0.60 Bypass WebKit Network IPC f10b871ab9 Gate InstallMockContentFilter IPC behind AllowTestOnlyMockContentFilterIPC preference
39 medium 0.60 TypeConfusion JSC DFG 7937fd75ae MapIteratorNext modeled statelessly so ObjectAllocationSinking/OSR-exit cannot leave Map/Set iterator partially or double-advanced
40 medium 0.60 UAF WebCore SerializedScriptValue / BroadcastChannel 84cde5ed5a SerializedScriptValue::deserialize must not be called more than once, affecting BroadcastChannel postMessage of shared buffers/WasmMemory

Other security-relevant

Sev Conf Class Component Commit One-liner
medium 0.58 Bypass WebKit UIProcess BackForwardList 791d472399
medium 0.55 Race WebCore Style 54e82182ce
medium 0.55 TypeConfusion WebCore LBSE SVG rendering f5722de1f7
medium 0.55 UAF WebGPU render pass 5b76a52475
medium 0.55 Race WebCore PlatformScreen ee05249166
medium 0.50 IntOverflow WebKit GPU media cb220370b4
medium 0.50 OOB ANGLE Metal e8902beae5
low 0.60 LogicError WebKit Shared Cocoa IPC df1c872b25
low 0.55 IntOverflow WebKit Shared TextExtraction fa10d866af
low 0.55 IntOverflow WebKit WebExtensions storage ea232f3860
low 0.50 LogicError WebCore Storage WorkerStorageConnection b0273bc189
low 0.50 UAF WebCore model-element de88d16504
low 0.50 LogicError WebCore Accessibility ce27a48eff
low 0.45 UAF JSC Wasm BBQ ControlData 96d0619b3a
low 0.45 UAF WebCore graphics FontCache 5c3bc51f9e
low 0.45 LogicError JSC JSObject 357d3881fd
low 0.45 LogicError WebCore WebCodecs VideoFrame 25570b9123
low 0.45 LogicError WebCore loader 65e6c589b7
low 0.40 Other WebCore CSS calc/anchor 8be326aece
dev 0.45 Other JSC DFG/FTL OSR exit 1d2be470ed