WebKit — 2026-W35
Clone-free silent-fix hunt over WebKit (GitHub-sourced), 2026-08-24 → 2026-08-30. Every candidate
below is cherry-picked from the week’s merged Source/ commits, triaged on the
patch-now / watch / noise ladder, given a full root-cause writeup, and put
through independent adversarial verification — the same bar as the Chrome
weekly reports.
This week. 91 candidates — 18 patch-now (RCE-class, attacker-reachable in default config), 19 watch (security-relevant but gated / weaker primitive / unproven), 54 noise, 0 duplicate. 9 root-caused · 9 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 0.85 | high | — | Source/WebCore/css |
dcb90d330710 |
Dangling reference into m_cache HashMap bucket rehashed by reentrant author script in CSSSegmentedFontFace::fontRanges |
| 🔴 patch-now · ✔︎verified | OOB-read | 0.8 | high | — | Source/WebCore/platform |
24545f4fcbd7 |
out-of-bounds frame-buffer-cache access and null backing-store deref when malformed images advertise more frames than exist |
| 🔴 patch-now | CrossOrigin | 0.8 | medium | — | Source/WebKit/NetworkProcess |
e1706a288fb5 |
Missing origin-to-connection authorization lets a web process register/post BroadcastChannel for origins it cannot access |
| 🔴 patch-now | CrossOrigin | 0.8 | medium | — | Source/WebKit/NetworkProcess |
e88c8b010e7f |
Missing origin-to-connection authorization lets a web process register/post BroadcastChannel for origins it cannot access |
| 🔴 patch-now · ~plausible | UAF | 0.8 | high | — | Source/JavaScriptCore/dfg |
f0847302d1f0 |
RangeBound::proof held a raw Relationship* into a Vector that could be reallocated in DFGIntegerRangeOptimizationPhase |
| 🔴 patch-now · ✔︎verified | UAF | 0.78 | high | — | Source/WebCore/platform |
5d23a56841c2 |
use-after-free of CoreLocationGeolocationProvider::Client when the owner is destroyed re-entrantly inside a CLLocationManager delegate callback |
| 🔴 patch-now · ✔︎verified | OOB-read | 0.75 | high | — | Source/WebGPU/ |
ff78e4fceef7 |
Index-validation high-water mark advanced before the clamp-shader validation pass actually ran, letting later draws skip validation in WebGPU Buffer |
| 🔴 patch-now | Race | 0.7 | medium | — | Source/WebKit/UIProcess |
e25bd0f0ddc7 |
Unsynchronized access/teardown race on m_momentumEventDispatcher between display-link thread and main thread |
| 🔴 patch-now | OOB-read | 0.68 | medium | — | Source/WebCore/Modules |
52e6da77b135 |
AudioBufferSourceNode reverse/offset playback reads source buffer past bufferLength |
| 🔴 patch-now · ✔︎verified | PolicyBypass | 0.68 | high | — | Source/WebKit/UIProcess |
81a9b86c9de1 |
cross-site back/forward navigation reuses the target item’s suspended-page process, granting it another site’s first-party privileges |
| 🔴 patch-now · ~plausible | LogicError | 0.65 | high | — | Source/JavaScriptCore/dfg |
c1b3dfb80501 |
incorrect inlined tail-call path for native functions in DFG/FTL emitCall |
| 🔴 patch-now | OOB-read | 0.65 | medium | — | Source/WebCore/Modules |
c2c8b0cb3b0d |
web-controlled AudioBuffer loop points produce an inverted range / out-of-range virtualReadIndex |
| 🔴 patch-now | Race | 0.62 | medium | — | Source/WebKit/WebProcess |
98f424e5b1b8 |
unsynchronized concurrent access to m_frameImages HashMap of RefCounted image pointers |
| 🔴 patch-now | OOB-write | 0.6 | medium | — | Source/WebCore/rendering |
04390f8f4dde |
out-of-bounds index into GridBaselineAlignment maxAscents when groupIndex exceeded the vector size |
| 🔴 patch-now | PolicyBypass | 0.6 | medium | — | Source/WebCore/loader |
075a8d041b63 |
window.open with noopener still set an opener on a reused existing frame, leaking an opener reference |
| 🔴 patch-now · ~plausible | UAF | 0.6 | high | — | Source/WebCore/dom |
5549b3663c5d |
contextDocument() freed by a Trusted Types policy callback during Attr::setValue |
| 🔴 patch-now · ✔︎verified | OOB-read | 0.6 | high | — | Source/WebGPU/ |
59b6d9a2d027 |
stale draw-indexed validation cache (keyed only on vertexCount) lets a mutated index buffer skip revalidation -> GPU OOB index/vertex fetch |
| 🔴 patch-now | UAF | 0.6 | medium | — | Source/WebCore/html |
f0d5be8210e3 |
Stale fontProxy/fontCascade reference used after CanvasFilterContextSwitcher::create may call save() in drawTextUnchecked |
| 🟡 watch | UAF | 0.55 | medium | — | Source/WebCore/workers |
b8d3efb7851e |
WorkerThread freed while its thread body still runs / shared-worker proxy thread started without an owner |
| 🟡 watch | InputValidation | 0.5 | medium | — | Source/WebCore/Modules/mediastream |
037843ae12ff |
setLocalDescription accepted an SDP whose DTLS a=fingerprint differed from the last created offer/answer |
| 🟡 watch | Race | 0.5 | medium | — | Source/WebCore/Modules |
2c0289313661 |
decodeAudioData shared a JS ArrayBuffer backing store with a worker thread instead of copying |
| 🟡 watch | Race | 0.5 | low | — | Source/WebKit/WebProcess |
9ba6cb68fcfb |
concurrent access to m_timestampToDuration StdUnorderedMap from decoder callbacks |
| 🟡 watch | InfoDisclosure | 0.45 | low | — | Source/JavaScriptCore/runtime |
c8fdf5eb819d |
importing module script URL leaked as Referer to non-HTTP scheme handlers |
| 🟡 watch | UAF | 0.42 | medium | — | Source/WebCore/css |
42b1e2aac2c7 |
raw reference to CSSSegmentedFontFace/constituent faces/FontCascade::fonts() held across opportunistic font loading |
| 🟡 watch | Spoofing | 0.4 | medium | — | Source/WebKit/NetworkProcess |
0c2c3da31e37 |
service-worker-served main resource response did not propagate its certificate info to the UI frame |
| 🟡 watch | UAF | 0.4 | low | — | Source/WebCore/html |
9972b95bf01b |
reentrant free of m_spinButtonOwner during focusAndSelectSpinButtonOwner() |
| 🟡 watch | UAF | 0.4 | low | — | Source/WebCore/html |
a7c0b0f9062b |
reentrant free of m_fieldOwner during focusOnNextField/didBlurFromField |
| 🟡 watch | UAF | 0.4 | low | — | Source/WebKit/UIProcess |
b0d927d67567 |
call into possibly-null/cleared m_momentumEventDispatcher from display-link callback |
| 🟡 watch | UAF | 0.4 | low | — | Source/WebCore/loader |
d40f4efab0e0 |
Element not kept alive across dispatchLoadEvent/dispatchErrorEvent reentrancy in ImageLoader |
| 🟡 watch | UAF | 0.38 | medium | — | Source/WebKit/GPUProcess |
5173c0afd8a3 |
AudioVideoRenderer left running past manager shutdown/destruction could call back into freed state |
| 🟡 watch | LogicError | 0.35 | low | — | Source/WebCore/svg |
19a32ddd2713 |
SVG pattern href chain had no cycle detection, allowing an unbounded href loop |
| 🟡 watch | UAF | 0.35 | medium | — | Source/WTF/ |
5c7edee974ae |
raw this/networkProcess() captures in async NetworkProcess callbacks could outlive their objects |
| 🟡 watch | AuthorizationError | 0.3 | low | — | Source/WebCore/html |
0748de334870 |
transcoded-file blob registration path-allow checks reworked for image transcoding over IPC |
| 🟡 watch | Spoofing | 0.3 | low | — | Source/WebKit/UIProcess |
0988eec0c5a2 |
certificate info for process-swap-on-navigation-response threaded explicitly instead of copied from old frame |
| 🟡 watch | UAF | 0.3 | medium | — | Source/WebCore/html |
6743d4ebb647 |
returned HashSet<Element*> of raw pointers could dangle before callers use them |
| 🟡 watch | UAF | 0.3 | low | — | Source/WebKit/UIProcess |
9bff36df8c41 |
FrameProcess torn down before old document finishes dispatching unload events during cross-process commit |
| ⚪ noise | LogicError | 0.3 | low | — | Source/WebKit/UIProcess |
bcee9e49e4dc |
none |
| ⚪ noise | LogicError | 0.3 | low | — | Source/JavaScriptCore/dfg |
ca74e529b927 |
none |
| 🟡 watch | LogicError | 0.25 | low | — | Source/WebCore/dom |
364b06df0efb |
hitTest could operate on a render tree torn down during layout of display:none subframes |
| ⚪ noise | LogicError | 0.25 | low | — | Source/WebCore/dom |
a8c31653e18a |
none |
| ⚪ noise | LogicError | 0.25 | low | — | Source/WebCore/Modules |
b5aef3f0e4fc |
none |
| ⚪ noise | LogicError | 0.2 | low | — | Source/WebCore/dom |
abf4ece815c8 |
none |
| ⚪ noise | NotSecurity | 0.2 | dev | — | Source/WebCore/SourcesCocoa.txt |
b17b55f6a8fb |
none |
| ⚪ noise | LogicError | 0.2 | low | — | Source/WebKit/UIProcess |
c42ab29ab466 |
none |
| ⚪ noise | LogicError | 0.2 | low | — | Source/WebCore/layout |
c9d5b3f137ca |
none |
| ⚪ noise | NotSecurity | 0.2 | dev | — | Source/WebCore/html |
ef17f9b10e30 |
none - canvas copyNativeImage refactor |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/WebCore/Modules |
03efc9761a39 |
n/a - rename setClientProcessSuspended->setClientSuspended and restructure suspended-client transaction scheduling |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/JavaScriptCore/runtime |
045a0c6379ef |
n/a - add line/column/sourceURL/stack to DOMException structured clone (clone version 15->16) |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/html |
63519535440f |
none - removes HTMLObjectElement/HTMLEmbedElement isExposed() filtering in document named-item resolution |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebKit/UIProcess |
713192fabebf |
none - defers provisional process DocumentSyncData until commit under site isolation |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/Headers.cmake |
8ce95bb31076 |
none - new regexp-free URLPattern matcher plus minor correctness tweaks |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/JavaScriptCore/b3 |
96b1030b8df4 |
none - Air greedy register allocator refactor + validation instrumentation + debug PrintSpecial fix |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/WebCore/html |
a3d2b19de176 |
none |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/WTF/ |
a90ff51d2225 |
none |
| ⚪ noise | LogicError | 0.15 | low | — | Source/WebCore/html |
cab391584f80 |
none |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/WebCore/rendering |
e1e984506198 |
none - rendering ownership refactor |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/page |
eb401eda2a84 |
none - remote-subframe mouse-capture routing correctness |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/Headers.cmake |
86e957015e02 |
none - new WebAuthn Related Origin Requests (.well-known/webauthn) feature |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/platform |
1392437bb060 |
n/a - add targetSession routing to processDidReceiveRemoteControlCommand and test hooks |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/platform |
1d650ab2580f |
n/a - add YUV/NV21 DMABuf import and Skia promise-image plumbing for GStreamer |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/ThirdParty/ANGLE/ |
296586e1c910 |
n/a - roll the ANGLE third-party dependency to a newer revision |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebKit/UIProcess |
3330d607a016 |
n/a - add macOS Live Text image-analysis gesture recognizers and deferral token |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebKit/UIProcess |
37462ea769c0 |
n/a - change WKAppKitGestureController to hold a WeakObjCPtr and split init/setUp |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebKit/UIProcess |
389a07672e9c |
none - feature work adding a forced display-refresh window for background text extraction |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/bytecode |
57d983744d82 |
none - StructureCache ShouldCacheStructure + mayBePrototype() fast path |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/accessibility |
585cb45609b3 |
none - accessibility nativeTextControl() accessor refactor and textMarkerRange override |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/page |
602545c636e6 |
none - richer text-extraction interaction target/neighbor-text label search |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/css |
64e677b027a4 |
none - adds support to text-decoration-inset |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/layout |
845882297cd2 |
none - ink overflow now accounts for multiple decorating ancestors |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/layout |
96aed036df64 |
none - defers inline ink-overflow computation to a post-layout pass |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/b3 |
ecc99e50298f |
none - Air FixObviousSpills performance optimization |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/SaferCPPExpectations |
fcd8c65d09ce |
none - SaferCPP protect()/RefPtr migration |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/editing |
07e24414b519 |
n/a - compute caret color with background-contrast adjustment |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/runtime |
0839f9342ed5 |
n/a - add a helper thread that pre-faults MarkedBlock pages |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/html |
1458014dcd44 |
n/a - cache player() in a local RefPtr instead of repeated protect(player()) calls |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/platform |
16c6a9971dac |
n/a - notify rate/playback-state changes on wireless route transitions |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/platform |
209e271d944e |
n/a - collect HDR screen properties asynchronously off the main thread |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/html |
24a47dd19793 |
n/a - honor non-ellipsis text-overflow values in text fields |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/runtime |
2ca559226b1b |
n/a - memoize/short-circuit lunisolar calendar month walks |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/runtime |
3302d7a45504 |
n/a - reserve SourceProviderCache map capacity from source length |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/dfg |
48985e195c6f |
none - refactor of DFG VariableEventStream from Vector to a LEB128 byte stream |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/rendering |
4b267e8636a2 |
none - adds backdrop-filter clip to non-round corner-shape contour |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/css |
66e2e265cfee |
none - CSSTokenizer String -> StringView API migration |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebKit/GPUProcess |
75a56647b267 |
none - threads connectionReceiveQueueQOS to the IPC client connection |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/dom |
b98b1c50745f |
none |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/css |
c11900808819 |
none |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/rendering |
f186fcf4e2e1 |
none - line-clamp layout condition |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/platform |
ff8fd01e634a |
none - vertical-font zero-width metric correctness |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebKit/Scripts |
97d426ec6562 |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebKit/UIProcess |
ceee5e9070b1 |
none |
| ⚪ noise | NotSecurity | 0.05 | dev | — | Source/WebKit/SourcesCocoa.txt |
dbe4d06e8673 |
none - new feature file |