WebKit — 2026-W36
Clone-free silent-fix hunt over WebKit (GitHub-sourced), 2026-08-31 → 2026-09-06. Every candidate
below is cherry-picked from the week’s merged Source/ commits, triaged on the
patch-now / watch / noise ladder, given a full root-cause writeup, and put
through independent adversarial verification — the same bar as the Chrome
weekly reports.
This week. 98 candidates — 34 patch-now (RCE-class, attacker-reachable in default config), 16 watch (security-relevant but gated / weaker primitive / unproven), 48 noise, 0 duplicate. 20 root-caused · 20 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 0.85 | high | — | Source/WebCore/page |
0bcd5c84c365 |
Use-after-free of ShareDataReader via BlobLoader completion handler capturing raw this |
| 🔴 patch-now · ✔︎verified | OOB-write | 0.85 | high | — | Source/WebCore/Headers.cmake |
3f8ee96594ae |
Out-of-bounds writes in image decoders from decoder rows/width exceeding the frame backing store |
| 🔴 patch-now · ✔︎verified | AuthorizationError | 0.85 | high | — | Source/WTF/ |
95b954b3bd0f |
WebContent process could name a back/forward item owned by another page via the process-global itemForID map |
| 🔴 patch-now · ✔︎verified | OOB-read | 0.8 | high | — | Source/WebGPU/ |
50724405dcc6 |
Stale indexed-indirect clamp verdict reused after index buffer contents change |
| 🔴 patch-now · ✔︎verified | UAF | 0.8 | high | — | Source/WebGPU/ |
97c5e65ca78e |
GPU reads host bytes via a newBufferWithBytesNoCopy MTLBuffer after the backing priorData/Vector is freed |
| 🔴 patch-now · ✔︎verified | AuthorizationError | 0.8 | high | — | Source/WebKit/NetworkProcess |
a57966243b6c |
any WebContent process could start/convert a download without UIProcess authorization or claim another process’s download |
| 🔴 patch-now · ✔︎verified | CrossOrigin | 0.8 | high | — | Source/WebKit/NetworkProcess |
bc550432a2f0 |
compromised WebContent process forges only the scheme of a shared worker’s top origin (scheme-blind first-party check) to launch a worker for a site it does not own |
| 🔴 patch-now · ✔︎verified | UAF | 0.78 | high | — | Source/WebGPU/ |
95c3cfc25878 |
MTLCommandBuffer completion handler / cached command buffer used after WebGPU Instance/CommandBuffer destroyed |
| 🔴 patch-now · ✔︎verified | OOB-read | 0.72 | high | — | Source/WebGPU/ |
54132281986c |
Index-validation high-water-mark allowed skipping revalidation of a cached draw |
| 🔴 patch-now · ✔︎verified | OOB-read | 0.72 | high | — | Source/WebGPU/ |
62de38739d77 |
Negative baseVertex omitted from indexed-draw validation cache key |
| 🔴 patch-now · ✔︎verified | OOB-read | 0.7 | high | — | Source/JavaScriptCore/dfg |
27eb122967d3 |
Out-of-bounds read in JSC string search when match length exceeds remaining subject |
| 🔴 patch-now · ✔︎verified | OOB-write | 0.7 | high | — | Source/WebCore/platform |
56c0a88ac8c4 |
Integer overflow in APNG fcTL bounds check lets frame rect exceed canvas |
| 🔴 patch-now · ✔︎verified | Race | 0.7 | high | — | Source/WebCore/css |
9849c73d66ed |
GC thread reads CSSRule parent union (m_parentRule/m_parentStyleSheet + m_parentIsRule) while main thread mutates it -> torn/stale pointer |
| 🔴 patch-now | IntegerOverflow | 0.7 | medium | — | Source/ThirdParty/libwebrtc |
d9c885fa52c8 |
A size_t payload length cast to int can become negative and bypass the ==0 guard, driving SplitAboutEqually with a negative length. |
| 🔴 patch-now · ✔︎verified | TypeConfusion | 0.7 | high | — | Source/WebGPU/ |
e77a4dbb49b6 |
A decayed WeakPtr to an auto-generated PipelineLayout made unrelated bind group layouts compare equal, so a BindGroup could feed wrong Metal argument-buffer slots to a pipeline compiled against a different layout. |
| 🔴 patch-now · ✔︎verified | UAF | 0.68 | high | — | Source/JavaScriptCore/heap |
c9c443b2fe16 |
A retired-but-live wasm BBQCallee can be overwritten by a new BBQ compile, leaving callers with dangling direct calls to freed JIT code. |
| 🔴 patch-now · ✔︎verified | Race | 0.68 | high | — | Source/WebCore/Modules |
eaacbbfb95cc |
The audio ring buffer and input/output descriptions were accessed by the realtime audio thread while the main thread replaced them, with no lock, giving a race/UAF on m_ringBuffer. |
| 🔴 patch-now · ✔︎verified | UAF | 0.65 | high | — | Source/WebCore/Modules |
3b7541f4fce8 |
Worklet thread observing a back-pointer to an AudioWorkletMessagingProxy after its refcount hit zero |
| 🔴 patch-now | OOB-read | 0.65 | medium | — | Source/WebCore/html |
3c0232a5d33e |
Off-by-one bottom-row detection in canvas noise-injection neighbor indexing |
| 🔴 patch-now | TypeConfusion | 0.65 | medium | — | Source/WebCore/style |
4847c476a821 |
Unchecked downcast on a RenderLineBreak default anchor |
| 🔴 patch-now | UAF | 0.65 | medium | — | Source/WebCore/css |
54c6c8c8bb23 |
Iterator/collection invalidation while iterating m_adoptingTreeScopes |
| 🔴 patch-now | Race | 0.65 | medium | — | Source/WebKit/WebProcess |
63fcf3b9df30 |
Unsynchronized m_sources/m_handlers maps and raw-pointer source handle |
| 🔴 patch-now | Race | 0.65 | medium | — | Source/WebCore/platform |
7224709bf074 |
Shared TinyLRUCache mutated/returned-by-reference across main and scrolling threads |
| 🔴 patch-now | IntegerOverflow | 0.65 | medium | — | Source/ThirdParty/libwebrtc |
ec56e39bc26f |
AV1 OBU size/offset arithmetic could overflow int, mis-sizing fragments during RTP packetization. |
| 🔴 patch-now | CrossOrigin | 0.65 | medium | — | Source/WebCore/loader |
f2a07be9fb74 |
Web (http/https) content could issue cross-origin no-cors subresource loads into a custom WKURLSchemeHandler app scheme and probe its contents. |
| 🔴 patch-now | PolicyBypass | 0.62 | medium | — | Source/WebKit/UIProcess |
e65c18148ecd |
The extension URL scheme handler resolved inline data:/symbol: resource paths, letting a request to the extension scheme decode arbitrary data URLs instead of only serving real extension files. |
| 🔴 patch-now · ✔︎verified | UAF | 0.6 | high | — | Source/WebGPU/ |
0d62770163df |
Updating a WebGPU external texture while bound/in-use by an open command encoder |
| 🔴 patch-now | CrossOrigin | 0.6 | medium | — | Source/WebCore/accessibility |
1f30924d488b |
Accessibility search escaping an iframe subtree to reach the main frame root |
| 🔴 patch-now · ✔︎verified | Race | 0.6 | high | — | Source/WebCore/page |
200be66fc92b |
Data race on IntersectionObserver target collections between GC marking thread and main thread |
| 🔴 patch-now | Race | 0.6 | medium | — | Source/WebCore/platform |
6cce7c11dbb0 |
AVPlayerItemVideoOutput released on delegate queue mutates KVO graph off main thread |
| 🔴 patch-now | Race | 0.6 | medium | — | Source/WebCore/page |
72bedbb9be63 |
scrollingTree() dereferenced without null/lifetime guard on the scrolling thread |
| 🔴 patch-now · ✔︎verified | UAF | 0.6 | high | — | Source/WebCore/platform |
d309c9d8e6c8 |
ShareableBitmap ImageBuffer backend’s releaseGraphicsContext was a no-op, so a serialized buffer handed to another RemoteRenderingBackend retained a live GraphicsContext holding cross-backend resource references touched from another work-queue thread. |
| 🔴 patch-now | UAF | 0.6 | medium | — | Source/WebCore/rendering |
f15a2f2705c4 |
listMarkerTextForNodeAndPosition returned a StringView into a temporary/local marker-text String, producing a dangling view read after the backing String was destroyed. |
| 🔴 patch-now | OOB-write | 0.5 | medium | — | Source/WTF/ |
da79705ade01 |
ScrollingStateTree::insertNode called insertChild at a childIndex that could be out of range after removeChild shrank the children vector. |
| 🟡 watch | Race | 0.55 | medium | — | Source/WebCore/platform |
5b052db563f4 |
RemoteImageDecoderAVF manager map accessed off main run loop |
| 🟡 watch | UAF | 0.5 | low | — | Source/WebCore/loader |
2507145cc7b1 |
Re-reading m_frame after a dispatchWillSendRequest client callout |
| 🟡 watch | IntegerOverflow | 0.5 | low | — | Source/JavaScriptCore/wasm |
8d7690313428 |
WASM IPInt branch toPop count unchecked before narrowing cast |
| 🟡 watch | CrossOrigin | 0.5 | medium | — | Source/WebKit/Platform |
aba0fcd53bea |
framework for validating untrusted IPC origins/domains/sites against a process’s first-party authority |
| 🟡 watch | PolicyBypass | 0.5 | medium | — | Source/WebKit/UIProcess |
bd4ce6001e93 |
a terminated shared WebContent process could be reused to host a new site under site isolation |
| 🟡 watch | LogicError | 0.4 | low | — | Source/WebCore/Modules |
0ad38fbf95da |
Bind-group entry equality never matched a bare GPUBuffer resource |
| 🟡 watch | LogicError | 0.4 | medium | — | Source/WebCore/dom |
3534a993db5d |
Shadow-including-root bookkeeping for the reused innerHTML/outerHTML document fragment |
| 🟡 watch | TypeConfusion | 0.4 | medium | — | Source/WebCore/Modules |
b3d7d6cdd798 |
WebGPU importExternalTexture passed a video playerIdentifier to the GPU process for a player not hosted there |
| 🟡 watch | UAF | 0.4 | medium | — | Source/WebKit/GPUProcess |
b7324636a862 |
video frame observer re-added on constraint change even when the source proxy was not observing media |
| 🟡 watch | LogicError | 0.35 | low | — | Source/WebCore/dom |
3a653d746ba1 |
parserContentPolicy/securityOriginPolicy not propagated to parseHTMLUnsafe and cloned documents |
| 🟡 watch | UAF | 0.35 | low | — | Source/WebCore/accessibility |
6d28d6994a1f |
Stale m_liveRegions iterator reused after buildLiveRegionSnapshot mutates the map |
| 🟡 watch | PolicyBypass | 0.35 | medium | — | Source/WebKit/UIProcess |
7b5f5df9aba3 |
Site-isolation FrameProcess reservation during navigation |
| 🟡 watch | LogicError | 0.35 | low | — | Source/WebCore/html |
a8a0b96619f3 |
PlaceholderRenderingContext::surfaceBufferToImageBuffer returned a null m_buffer to callers expecting a valid ImageBuffer |
| 🟡 watch | UAF | 0.3 | low | — | Source/WebCore/platform |
d3e5e156482f |
TrackingAndRenderingClient dereferenced without protecting it, so it could be destroyed mid-callback. |
| 🟡 watch | Race | 0.25 | dev | — | Source/JavaScriptCore/jit |
1edc620316f5 |
GC/compilation thread touching main-thread-only heap bookkeeping; JIT constant-char read hardening |
| ⚪ noise | LogicError | 0.2 | low | — | Source/WebCore/rendering |
9deb9f6ab200 |
fixed-size background tile width/height not clamped up to devicePixelSize for non-zero values |
| ⚪ noise | LogicError | 0.2 | low | — | Source/WebCore/page |
bd7861b451f2 |
remote-frame layout info sent parent window-clip rect in parent content coordinates instead of child-view coordinates |
| 🟡 watch | UAF | 0.2 | low | — | Source/WebKit/UIProcess |
dfec1c79caab |
_textInteractionWrapper dereferenced without retaining it across potentially re-entrant calls. |
| ⚪ noise | NotSecurity | 0.18 | low | — | Source/WebCore/workers |
99d64d9ab12b |
ServiceWorker event dispatch consolidated into queueTaskToFireEvent with an activeDOMObjectsAreStopped guard |
| ⚪ noise | LogicError | 0.18 | low | — | Source/WebKit/UIProcess |
b8e586fe8c30 |
RemotePageProxy creation logic for shared-process / site-isolation reworked |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/rendering |
4b6b2cdc9092 |
Repaint-rect / pixel-moving-filter accounting refactor |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/accessibility |
4b95b757c6de |
Accessibility collapsed-trailing-newline line-range reworking |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/layout |
65dd1d3fccd0 |
List-item excluded marker position shift during line layout |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/html |
715af9163fd6 |
Canvas copiedImage->copyNativeImage migration and WebGL alpha-premultiplication rework |
| ⚪ noise | LogicError | 0.15 | low | — | Source/WebCore/Modules |
946a6c01843c |
DOMCache.remove/keys swallowed requestFromInfo exceptions as resolve(false) instead of rejecting |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/JavaScriptCore/yarr |
956f6fb49678 |
none - YARR interpreter read/check functions unified under a MatchDirection parameter |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/JavaScriptCore/wasm |
ca158eb19b75 |
Feature work adding qWasmInstance to the wasm GDB-remote debugger plus minor parse hardening. |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/svg |
d6e2e670e847 |
Avoids creating SMIL style properties just to remove one, and drops a connectivity guard. |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/dom |
dcb25ff14a12 |
Newly-registered highlights were not forced to recompute their positions before paint. |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/html |
de2a960750b4 |
Migrates canvas drawImage/read paths to immutable NativeImage snapshots. |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/accessibility |
ef1d7119a4db |
Off-by-one in AX-thread text length for text controls whose value ends in a line break. |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/rendering |
fdc812b2d80b |
Restructures when list marker counter content is filled relative to render-tree changes. |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/html |
7067ca63e913 |
Seekable-time-ranges change notification plumbing |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/Headers.cmake |
86e957015e02 |
WebAuthn Related Origins (.well-known/webauthn) validation feature |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/dom |
0c1ebfc04931 |
n/a - AirPlay picker frame plumbing and test instrumentation |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/dfg |
0d6cf47c3b12 |
n/a - SIMD vectorization of Array indexOf/includes for doubles |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/dom |
3b068d9c3d5f |
n/a - caching isFullyActive during IntersectionObserver updates |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/page |
4cc311091515 |
Text-extraction visual-proxy feature for transparent checkbox/radio |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/accessibility |
585cb45609b3 |
nativeTextControl()/textMarkerRange() accessibility refactor |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/rendering |
6787a18c749f |
Bezier/path flattening for CSS corner-shape shape-outside |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/accessibility |
7800a5152b1f |
Suppress AX text runs for input/textarea placeholder text |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/Modules |
99127ce297d9 |
none - computes media controls context menu anchor rect across isolated frames |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WTF/ |
c10e14c1ae42 |
none - WebTransport nw_* soft-linking and a defaultWebTransportEnabled() init gate |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/platform |
d730f4ad0ffd |
Consolidates GraphicsContextGL::createNativeImageFromPixelBuffer into NativeImage::create(PixelBuffer, hasAlpha). |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebKit/UIProcess |
d732d3bb8689 |
magnification() returned the stale pre-gesture page scale during the transient-zoom commit window. |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/layout |
10f92fc9ecb7 |
n/a - list-item outside-marker layout rework |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/page |
1207e682053f |
n/a - text-extraction stale-node re-resolution feature |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/loader |
162e02396fa2 |
n/a - content-blocker blocked-load notification plumbing |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/platform |
209e271d944e |
n/a - async screen-properties/HDR collection and caching |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/ThirdParty/ANGLE/ |
296586e1c910 |
n/a - ANGLE dependency roll |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/testing |
2a20415140e2 |
n/a - null-checks in test-only history/file-path dumping |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/runtime |
2e5ec08882e6 |
n/a - Intl.PluralRules IntlMathematicalValue support |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/accessibility |
321cf5cc81d7 |
n/a - accessibility stitch-group placement of excluded list markers |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/platform |
8445610f3e92 |
Only force layer display when the repaint counter is shown |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/html |
97577612f28b |
none - posts AX URLChanged notification when HTMLMediaElement currentSrc changes |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/rendering |
a9d1f86cb574 |
none - removes UseSkiaForComposition pref and reworks GTK/WPE Skia vs TextureMapper composition paths |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/css |
ae4e64022c2f |
none - adds ShouldReportDesktopClassPointingDevice setting feeding hover/pointer media queries |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/loader |
b90b184ba424 |
none - threads Style::LinkParameters through CachedImage/SVG and adds env-var link parameter values |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/accessibility |
bb09e1b5e8a6 |
none - threads DescendIntoContainers through accessible-name computation |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebKit/UIProcess |
c0646476dd49 |
none - adds a didCompleteApplePayPayment UI delegate notification |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/runtime |
cbd15fc88bde |
Adds Karatsuba multiplication algorithm to JSBigInt. |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/Modules |
dc774f0cde65 |
Rewrites Variant handling in ClipboardItemBindingsDataSource using WTF::switchOn. |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WTF/ |
dc960d597efc |
Adds alpha-channel support to the GTK/WPE color chooser. |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/css |
126c191252fd |
n/a - CSS flex-wrap:balance feature behind a disabled flag |