WebKit — 2026-W40
Clone-free silent-fix hunt over WebKit (GitHub-sourced), 2026-09-28 → 2026-10-04. Every candidate
below is cherry-picked from the week’s merged Source/ commits, triaged on the
patch-now / watch / noise ladder, given a full root-cause writeup, and put
through independent adversarial verification — the same bar as the Chrome
weekly reports.
This week. 13 candidates — 2 patch-now (RCE-class, attacker-reachable in default config), 2 watch (security-relevant but gated / weaker primitive / unproven), 9 noise, 0 duplicate. 2 root-caused · 2 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | CrossOrigin | 0.72 | high | — | Source/WebCore/dom |
10740b3a1fa5 |
cross-origin-isolated and non-isolated documents sharing a WebProcess / missing COEP navigation enforcement |
| 🔴 patch-now · ~plausible | TypeConfusion | 0.65 | high | — | Source/JavaScriptCore/b3 |
33ca66ce3ffe |
B3 JIT miscompile: stale/incorrect store-to-load forwarding of Wasm GC struct/array fields |
| 🟡 watch | InputValidation | 0.48 | low | — | Source/WebCore/html |
28001e7f6612 |
null std::unique_ptr moved into OffscreenCanvas::create during structured-clone deserialize |
| 🟡 watch | Race | 0.3 | low | — | Source/JavaScriptCore/heap |
152ae41b47b1 |
GC collector-thread shutdown race (conn handoff after m_threadShouldStop) |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/loader |
0c4284a07df5 |
none (cache-only load retry provisional-load-failure reporting) |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/rendering |
0702fdd8610d |
none (CSS line-clamp counting correctness across independent formatting contexts) |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/page |
cae8ae4bceca |
none (site-isolation drag-source frame routing for dragend/dragcancel) |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/layout |
30f62637197d |
none (CSS block-ellipsis line-clamp feature implementation) |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/layout |
5530f57c3581 |
none (line-clamp contentFitsWithinMaximumLines / nested-block clamp budget) |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/layout |
68122f6dfc12 |
none (line-clamp: auto automatic clamp-point computation) |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/rendering |
a8503ad8259e |
none (multicol container treated as continue:auto for line-clamp) |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/layout |
f150bb535660 |
none (line-clamp block-ellipsis last-line/revert bookkeeping) |
| ⚪ noise | NotSecurity | 0.08 | low | — | Source/WebCore/css |
c572e93fff39 |
none (migrate -webkit-line-clamp to max-lines/block-ellipsis/continue shorthand) |