WebKit — 2026-W38
Clone-free silent-fix hunt over WebKit (GitHub-sourced), 2026-09-14 → 2026-09-20. Every candidate
below is cherry-picked from the week’s merged Source/ commits, triaged on the
patch-now / watch / noise ladder, given a full root-cause writeup, and put
through independent adversarial verification — the same bar as the Chrome
weekly reports.
This week. 80 candidates — 13 patch-now (RCE-class, attacker-reachable in default config), 14 watch (security-relevant but gated / weaker primitive / unproven), 53 noise, 0 duplicate. 5 root-caused · 5 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | UAF | 0.8 | high | — | Source/WebCore/dom |
56909e17f99a |
premature blob URL/data revocation across cross-process message dispatch (postMessage/BroadcastChannel/service worker) |
| 🔴 patch-now · ✔︎verified | UAF | 0.72 | high | — | Source/WebGPU/ |
34cd00bb8393 |
GPU-aliased CPU bytes (newBufferWithBytesNoCopy) read after the backing Vector is freed during WebGPU buffer clear/restore |
| 🔴 patch-now · ✔︎verified | UAF | 0.72 | high | — | Source/JavaScriptCore/runtime |
9e7715c04353 |
resizable non-shared Wasm memory grow left ArrayBuffer/views pointing at freed Gigacage pages |
| 🔴 patch-now · ✔︎verified | OOB-read | 0.7 | high | — | Source/WebCore/platform |
49e046b1a9fb |
unvalidated numberOfFrames from WebProcess IPC exceeding CARingBuffer frame count in speech-recognition audio |
| 🔴 patch-now · ✔︎verified | UAF | 0.68 | high | — | Source/WebCore/css |
0916f620f042 |
in-place mutation of shared/cached StyleSheetContents via CSSStyleSheet.replaceSync() |
| 🔴 patch-now | InfoDisclosure | 0.66 | medium | — | Source/WebKit/UIProcess |
1577f67ea06b |
global cursor screen location leaked to web content when window unfocused or cursor outside view |
| 🔴 patch-now | UAF | 0.62 | medium | — | Source/WebCore/page |
60fe8ff35a4a |
iterator invalidation / page destruction while iterating the global allPages() set |
| 🔴 patch-now | CrossOrigin | 0.62 | medium | — | Source/WebCore/loader |
63846dd9cddb |
DidCommitLoadForFrame reporting the outgoing document’s origin/CSP on a back/forward-cache restore |
| 🔴 patch-now | UAF | 0.62 | medium | — | Source/WebCore/html |
e00bb56e7fce |
re-entrant WebGL context creation overwrote an already-assigned m_context, dropping/dangling a live context |
| 🔴 patch-now | UAF | 0.6 | medium | — | Source/WebCore/Modules |
57d9da4c518b |
FetchBody FormData outliving its source DOMFormData (dangling entry/blob references) |
| 🔴 patch-now | OOB-read | 0.6 | medium | — | Source/WebCore/platform |
57fe70249734 |
Vector::first() on an empty keyIDs list in FairPlay license update |
| 🔴 patch-now | AuthorizationError | 0.6 | medium | — | Source/WebKit/UIProcess |
71e6e852300a |
display-capture sandbox capability activated/retained without user authorization |
| 🔴 patch-now | UAF | 0.6 | medium | — | Source/WebCore/html |
bdc3067a395f |
dangling CheckedPtr to a RenderBox freed by JS run during spin-button mouse handling |
| 🟡 watch | InputValidation | 0.55 | medium | — | Source/WebCore/editing |
b2dca993516f |
untrusted unsupported-type image bytes decoded by the privileged UIProcess (text attachments / saveImageToLibrary / share sheet) |
| 🟡 watch | LogicError | 0.55 | medium | — | Source/WebCore/html |
e0558372aafc |
Canvas2D beginLayer() proceeds to build a filter/layer even when save states were not fully realized, desyncing the save/layer stack. |
| 🟡 watch | UAF | 0.5 | medium | — | Source/WebKit/WebProcess |
430a7b5b2f21 |
unretained accessibility root wrapper returned from a secondary thread |
| 🟡 watch | UAF | 0.5 | medium | — | Source/WebCore/rendering |
68af3881b5ea |
out-of-flow boxes left in a containing block’s positioned-objects list on style change of a non-RenderBlock |
| 🟡 watch | Spoofing | 0.45 | medium | — | Source/WebCore/loader |
2df02878fefc |
subframe initial about:blank navigation creating a new back/forward item |
| 🟡 watch | UAF | 0.45 | medium | — | Source/WebKit/UIProcess |
8a4399c3a296 |
animation timelines/nodes not cleaned up when a remote web content process terminates |
| 🟡 watch | PolicyBypass | 0.45 | medium | — | Source/WebKit/UIProcess |
c6c32eb84a8d |
site-isolated main-frame site could remain in the shared web process after a BCG swap |
| 🟡 watch | LogicError | 0.42 | medium | — | Source/WebCore/Modules |
c2c736166c9a |
ReadableStream BYOB tee applied byob/other cancel flags to the wrong branch |
| 🟡 watch | UAF | 0.4 | medium | — | Source/WebCore/loader |
1b1d1e50831f |
reusing an already-committed provisional DocumentLoader on a failed back/forward cache restore |
| 🟡 watch | LogicError | 0.4 | medium | — | Source/JavaScriptCore/runtime |
34ccaa804ca9 |
missing exception checks in structured-clone array-buffer-view deserialization |
| 🟡 watch | IntegerOverflow | 0.38 | low | — | Source/WebCore/layout |
2eeda48d71f8 |
negative grid content-box size from margins+border+padding exceeding available space |
| 🟡 watch | LogicError | 0.35 | medium | — | Source/WebKit/UIProcess |
11ce3debf287 |
suspending current page whose main frame is the provisional page’s commit target during process swap |
| 🟡 watch | UAF | 0.35 | medium | — | Source/JavaScriptCore/runtime |
7f5ab158824b |
WeakBlock surviving across MarkedBlock cell-size/owner change reading stale mark bits |
| 🟡 watch | LogicError | 0.3 | dev | — | Source/JavaScriptCore/runtime |
125543708a96 |
null TypeLocation deref and offset integer overflow in $vm.findTypeForExpression |
| ⚪ noise | LogicError | 0.25 | low | — | Source/WebCore/bindings |
c963a9e4dece |
none - forced-gesture (evaluateJavaScript:) transient activation was over-consumed |
| ⚪ noise | NotSecurity | 0.18 | low | — | Source/WebCore/page |
da6f3a668758 |
none - FocusController uses localMainOrRootFrame for site isolation |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/WTF/ |
1f5c9bec546e |
none - SecurityFlags distribution hardened to a read-only shared memory page |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/dom |
4448da03e085 |
none - SaferCPP RefPtr/CheckedPtr migration of ownerElement/renderer in Document::implicitClose |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebGPU/ |
6266be9b8a61 |
none - WebGPU pipeline creation made asynchronous (refactor) |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebKit/Platform |
9ea68824aec3 |
none - position-information IPC moved to typed async reply |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/JavaScriptCore/runtime |
a5bfdb3aaf30 |
none - Error.stackTraceLimit read from constructor property instead of cached field |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/html |
b871911a6d8e |
none - WebGL texImage alpha-premultiplication source-of-truth correctness |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/JavaScriptCore/runtime |
d2cffa902fba |
none - structured-clone serializer/deserializer base classes extracted and shared |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/JavaScriptCore/runtime |
d2d61f8871a4 |
none - BigInt multiplySchoolbook rewritten from raw pointers to spans |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/rendering |
4e1820c0d71e |
none - img-represents-nothing sizing refactor |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/dom |
613afab6d7a2 |
none - load-completion plumbing for remote frames |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/html |
68516a66b91d |
none - SaferCPP protect()/Ref accessibility migration |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/WebCore.xcodeproj |
7609f9143f80 |
none - Compression Dictionary Transport (Use-As-Dictionary) feature |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/Modules/mediastream |
77e8645084e6 |
none - SaferCPP protectedThis/NOESCAPE static-analyzer sweep |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebKit/Shared |
8e4d67498529 |
none - parentFrameIsMainFrame plumbing for extension webRequest |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/JavaScriptCore/runtime |
f5430ef75dd3 |
none - CString->ASCIICString type refactor for ICU locales |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/wasm |
0aac8dcd47b6 |
none - Wasm breakpoint manager claim/lifetime refactor |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebKit/UIProcess |
1e74ca99e940 |
none - new WebDriver BiDi captureScreenshot command |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/page |
249b15d9fda8 |
none - site-specific quirks condition framework generalization |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/css |
24d831f77f5e |
none - optgroup label / html-aware text content refactor |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/html |
2c67cb17aa9c |
none - HTMLImageElement naturalSize() helper extraction |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/rendering |
38da305a284f |
none - plumb isInResizeControl into position information |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/page |
41c908b6b671 |
none - dedupe redundant frame-geometry IPC broadcasts |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebKit/UIProcess |
4fcbbaa90749 |
none - window frame reporting API change |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/platform |
5cd715482960 |
none - Qualcomm DMABuf video-frame import feature |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WTF/ |
8009ddd21582 |
none - UIProcess periodic memory monitor feature |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/loader |
872a0ddf5a18 |
none - delegated back/forward navigation wait-state simplification |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/dom |
97b07fcffda0 |
none - IDL BufferSource binding type unification refactor |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/editing |
a2b7a1b2e360 |
none - Image -> BitmapImage type narrowing across attachment/notification/reveal code |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/page |
a4ef371d3c80 |
none - preserve pending-drag state across synthesized context-menu press; image-analysis gesture caching |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebKit/Scripts |
af71d8f847f7 |
none - REVEAL context-menu selection threaded for site isolation |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/wasm |
d8d357754956 |
none - Wasm LLDB breakpoint manager keyed by Breakpoint and reads original opcode |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/dom |
e9945d774ab6 |
none - SaferCPP RefPtr migration |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/runtime |
08f5b5c35ece |
none - Wasm debugger session-state rename/refactor |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/dfg |
219167e2b464 |
none - DFG OSR exit dispatch mechanism refactor |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/css |
37707f5c5229 |
none - CSS scroll-state(scrollable) container query implementation |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/css |
3e1e77d2baa0 |
none - new RenderGlyph for UA-drawn picker chevrons |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/Modules |
4e7a14b5f961 |
none - RefPtr/null-check hygiene refactor |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/platform |
5012c3c587d2 |
none - display() bool->void signature refactor |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/platform |
57e694a6b984 |
none - TextureMapperAnimation -> AcceleratedAnimation rename/move |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/rendering |
76bf3bb6fcdf |
none - LayerOverlapMap rect containment dedup optimization |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/bytecode |
95a960a3ae94 |
none - logging/assert format-arg API cleanup |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/html |
98ff5ead9890 |
none - adds media-fragment #track dimension selection |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/JavaScriptCore/runtime |
9a3812428186 |
none - new FFT (Schonhage-Strassen) BigInt multiply ported from V8 |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/css |
9c43b4a10979 |
none - Web Inspector CSS nested-declarations display |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/wasm |
9f9aae3434d3 |
none - Wasm LLDB debugger one-time breakpoint generalization |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/Modules/mediastream |
a6cba35ff796 |
none - mass protect()/Ref SaferCPP migration |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/dom |
d6f958d63e3c |
none - AX custom color mode controller plumbing |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/html |
d719d23779c2 |
none - ImageBitmap HDR / extended-color-space support |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/svg |
d9714228c9f8 |
none - SVG textPath ‘path’ attribute (SVG2) support |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/bytecode |
e57b0d167091 |
none - storage-format refactor |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/Configurations |
f25af0d17d46 |
none - SPI-to-public-API migration |