WebKit — 2026-W41
Clone-free silent-fix hunt over WebKit (GitHub-sourced), 2026-10-05 → 2026-10-11. Every candidate
below is cherry-picked from the week’s merged Source/ commits, triaged on the
patch-now / watch / noise ladder, given a full root-cause writeup, and put
through independent adversarial verification — the same bar as the Chrome
weekly reports.
This week. 147 candidates — 10 patch-now (RCE-class, attacker-reachable in default config), 18 watch (security-relevant but gated / weaker primitive / unproven), 119 noise, 0 duplicate. 11 root-caused · 11 tier-2 verified.
Candidates
Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.
| Verdict | Class | Conf | Sev | CVSS | Component | Commit | Primitive |
|---|---|---|---|---|---|---|---|
| 🔴 patch-now · ✔︎verified | PolicyBypass | 0.78 | medium | — | Source/WebCore/dom |
87b3951978a0 |
Compromised web process spoofs isMainFrameLoad / under-reports source origin+address space to skip the Local Network Access permission check |
| 🔴 patch-now · ~plausible | UAF | 0.72 | high | — | Source/WebCore/page |
b7bbb825266a |
re-entrant RemoteFrame::frameDetached via unload handler causing double detach / frame-tree UAF |
| 🔴 patch-now · ✔︎verified | CrossOrigin | 0.72 | high | — | Source/WebCore/dom |
db89016bcf99 |
same-origin DOM-access checks ignored agent cluster, letting same-origin documents in different agent clusters access each other’s objects |
| 🔴 patch-now · ✔︎verified | PolicyBypass | 0.62 | medium | — | Source/WebCore/dom |
a39a3c616a34 |
A document inside an insecure cross-process (remote) ancestor is treated as a secure context, unlocking secure-context-gated APIs |
| 🔴 patch-now · ✔︎verified | OOB-write | 0.6 | medium | — | Source/WebCore/html |
2522677a2f56 |
WebGL default drawing-buffer/canvas size not clamped to real GL/compositor (IOSurface) limits |
| 🔴 patch-now · ✔︎verified | Spoofing | 0.6 | medium | — | Source/WebKit/UIProcess |
26556dce7408 |
UIProcess trusted renderer-supplied topOrigin/documentOrigin for Digital Credentials request |
| 🔴 patch-now · ✔︎verified | CrossOrigin | 0.6 | medium | — | Source/WebKit/WebProcess |
98c97d08a135 |
A tap on a cross-origin remote subframe owner’s border/padding is routed into the remote frame without verifying the hit-test landed on frame content |
| 🔴 patch-now · ✔︎verified | PolicyBypass | 0.6 | medium | — | Source/WebKit/UIProcess |
c5006bd78735 |
stale cross-process forced user-activation tokens not revoked on frame teardown/navigation/process exit |
| 🔴 patch-now · ✔︎verified | LogicError | 0.6 | medium | — | Source/WebKit/UIProcess |
fc5ea9bf36db |
stale/closed page or swapped main frame processed after async navigation-action policy decision |
| 🔴 patch-now | UAF | 0.5 | medium | — | Source/WebKit/Scripts |
7de1b0baff8f |
use-after-free via raw ’this’ captured in PostRenderingUpdate RunLoopObserver |
| 🟡 watch · ~plausible | PolicyBypass | 0.65 | low | — | Source/WebCore/dom |
81d9a71bf3fe |
cross-process spoofing of forced user activation via unvalidated token |
| 🟡 watch · ~plausible | PolicyBypass | 0.6 | low | — | Source/WebCore/Modules/mediastream |
86d0164f8307 |
structured-clone deserialization materialized interfaces not exposed in the target global |
| 🟡 watch | Spoofing | 0.5 | medium | — | Source/WebCore/loader |
9804a95e0967 |
A web process reports a NavigationIdentifier minted by another process, causing cross-process navigation-ID confusion |
| 🟡 watch | UAF | 0.5 | medium | — | Source/WebCore/html |
bb5913e37d01 |
stale HTMLHRElement/HTMLOptGroupElement m_ownerSelect after an atomic DOM move |
| 🟡 watch | AuthorizationError | 0.4 | medium | — | Source/WebCore/dom |
b2fb1f240e25 |
Storage keying for frames with unpartitioned storage access, with IPC validation that a web process only claims storage client origins it committed |
| 🟡 watch | CrossOrigin | 0.4 | medium | — | Source/WebKit/UIProcess |
ca9cf2bac154 |
agent-cluster keying used the page’s stale browsing context group instead of the committing provisional page’s group |
| 🟡 watch | PolicyBypass | 0.4 | medium | — | Source/WebCore/dom |
d0aabe7a8b22 |
secure-context for COEP/DIP/origin-agent-cluster derived from the response URL alone, ignoring the ancestor chain |
| 🟡 watch | TypeConfusion | 0.35 | medium | — | Source/JavaScriptCore/dfg |
4dab012045bc |
DFG constant-folding of ObjectDefineProperty with an object-typed key |
| 🟡 watch | IntegerOverflow | 0.35 | low | — | Source/WebCore/dom |
76ed77ce7f2a |
signed-int overflow (UB) in circularSequentialID counter wrap |
| 🟡 watch | InputValidation | 0.35 | low | — | Source/WebCore/platform |
790f56e77cc4 |
null pixel-buffer deref / unhandled pixel formats in VPX encoder |
| 🟡 watch | UAF | 0.35 | low | — | Source/WebCore/inspector |
cd17a97f6273 |
inspector frontend channel outliving its LocalFrame across a process swap (stale m_inspectedFrame) |
| 🟡 watch | LogicError | 0.33 | low | — | Source/WebKit/UIProcess |
bf9a4e5956dd |
positional fallback pairing wrong from-child in per-frame back/forward traversal, double-dispatching to a live frame |
| 🟡 watch | UAF | 0.3 | low | — | Source/WebCore/Modules/mediastream |
37be53d3c310 |
potential UAF from raw this captured in async callbacks |
| 🟡 watch | CrossOrigin | 0.3 | medium | — | Source/WebCore/dom |
4c1da06718e4 |
unpartitioned (first-party) cookie access granted to web-extension subframes |
| 🟡 watch | UAF | 0.3 | low | — | Source/WebKit/NetworkProcess |
5365d75de10a |
potential use of unprotected call args / captured raw pointers |
| 🟡 watch | UAF | 0.3 | low | — | Source/WebCore/inspector |
7efb1f141dd0 |
inspector media event listeners not removed on frontend disconnect |
| 🟡 watch | LogicError | 0.3 | low | — | Source/WebCore/dom |
c413d63ffc92 |
cyclic popover invoker chain causing unbounded focus traversal |
| 🟡 watch | LogicError | 0.25 | low | — | Source/WebCore/history |
dd106cbc0209 |
cached local root frame left in Page::rootFrames() and receiving rendering updates |
| ⚪ noise | NotSecurity | 0.2 | low | — | Source/WebCore/html |
413e8f64cc26 |
possible null deref of player() in setVolumeLocked |
| ⚪ noise | NotSecurity | 0.2 | low | — | Source/WebKit/UIProcess |
5b7a109714d5 |
stale inspector target/connection across process swap |
| ⚪ noise | NotSecurity | 0.18 | low | — | Source/WebKit/UIProcess |
09895fc3ff2f |
none - reuse existing provisional frame on subframe navigation (site isolation) |
| ⚪ noise | NotSecurity | 0.18 | low | — | Source/WebCore/dom |
74af04025b3b |
none - makes never-rendered SVG elements non-focusable |
| ⚪ noise | NotSecurity | 0.18 | dev | — | Source/JavaScriptCore/ftl |
7fbbbd1f450b |
none - FTL B3 lowering optimizations |
| ⚪ noise | NotSecurity | 0.18 | low | — | Source/WebCore/html |
814ebe2cfe6a |
none - HTMLSelectElement picker/popover open-state refactor |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/Modules/mediastream |
0067ec3e7b9b |
none - TZone allocation + CheckedRef migration of LibWebRTC observer members |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebKit/UIProcess |
03669a4d45f5 |
none - route ElementContext messages to the owning process (site isolation) |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/WebCore/rendering |
0ea1d42264fb |
none - RenderLayer canvasDrawableRecorder raw pointer to RefPtr |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/dom |
21142271a7e1 |
none - spec-conformance refactor of ViewTransition update-callback scheduling |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/html |
2acc8d01bcdc |
none - accessibility setSelected consolidation |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/dom |
31ea7826bd94 |
none - quirks re-evaluation on top-document URL change |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/loader |
3328994e4d88 |
none - remove SVGResourceImage, fold SVG-resource drawing into CachedImage |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/inspector |
36c8ec5fdabf |
none - InspectorOverlay site-isolation (per-frame overlay) refactor |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/dom |
581b4484918e |
none - Range client-rect layout for content-visibility |
| ⚪ noise | NotSecurity | 0.15 | dev | — | Source/CMakeLists.txt |
668135a369dd |
none - WebGPU InternalAPI -> C++ API migration |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/accessibility |
698650b1c485 |
none - AXIsolatedObject main-thread callback object correctness |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/accessibility |
96cb7254785e |
none |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/rendering |
a91e441ffeff |
none |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebCore/platform |
a9bd62bea8c1 |
none |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/JavaScriptCore/jit |
ab081a2baf54 |
none |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebKit/NetworkProcess |
f68f1ed56d27 |
none - honors no-cache / stale-while-revalidate for compression-dictionary freshness |
| ⚪ noise | NotSecurity | 0.15 | low | — | Source/WebKit/UIProcess |
fb84f8c54e5f |
none - threads FrameIdentifier through app-highlight and getSelectionOrContentsAsString IPC |
| ⚪ noise | NotSecurity | 0.14 | low | — | Source/WebCore/Modules |
b7416f7b3764 |
none |
| ⚪ noise | NotSecurity | 0.14 | low | — | Source/WebKit/UIProcess |
bc2d3dae195d |
none |
| ⚪ noise | NotSecurity | 0.14 | low | — | Source/WebCore/html |
fc7a51c3f65d |
none - makes DisplayList::RecorderImpl RefCounted, migrates owners to Ref/RefPtr |
| ⚪ noise | NotSecurity | 0.13 | dev | — | Source/WebCore/rendering |
6276679c922a |
none - SVG text-chunk data-structure refactor |
| ⚪ noise | NotSecurity | 0.13 | dev | — | Source/WebCore/layout |
71e49219a946 |
none - line-clamp float block-end clipping (css-overflow-4) |
| ⚪ noise | NotSecurity | 0.13 | dev | — | Source/WebCore/layout |
848538f2e9b5 |
none - inline truncation threads explicit inline-direction flag |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/dom |
bf92727c9d35 |
none |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebCore/dom |
d46884a91159 |
none |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebKit/GPUProcess |
ecf56860317f |
none - bulk protect()/RefPtr/Ref Safer-C++ hardening across NetworkProcess/UIProcess/WebProcess |
| ⚪ noise | NotSecurity | 0.13 | low | — | Source/WebKit/UIProcess |
ed2a17c1cc51 |
none - moves provisional-process reuse into WebProcessPool::processForSite |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/layout |
000b2c7d4a75 |
none - SaferCPP CheckedRef/protect annotation on style & fontCascade refs |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/layout |
07c0febdf78a |
none - SVG text layout rewritten to index-based per-box fragments |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/dom |
240e5121f5b0 |
none - inspector debugger-suspension logic moved to a new controller |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/layout |
277305bef9b0 |
none - CheckedPtr/CheckedRef downcast rvalue-overload API change |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/dom |
29c530c9e357 |
none - cross-document view-transition navigation deferral feature |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/layout |
34f64e25f0cf |
none - SVG text display-content builder smart-pointer hardening |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/CMakeLists.txt |
381bb9cae12a |
none - new ProofOfPossession module and build wiring |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/html |
3f0218e592b8 |
none - remove CustomPaintImage, inline CSS Paint drawing into PaintImage |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/JavaScriptCore/inspector |
41d4de49d3c6 |
none - per-frame Canvas inspector agent for Site Isolation |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/JavaScriptCore/inspector |
427feb8178e4 |
none - per-frame CSS layout-flags inspector agent for Site Isolation |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/JavaScriptCore/inspector |
4424ae9f33de |
none - per-frame DOMStorage inspector agent event routing |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/inspector |
64611e1e3f2b |
none - Inspector IndexedDB agent split into Frame/Page subclasses |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebKit/ModelProcess |
647e75bd9c97 |
none - volumetric scene hit-sphere feature for visionOS |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/dom |
6d581f5af3ee |
none - requestAnimationFrame callback id type widened int->unsigned |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/accessibility |
6e8da912601c |
none - accessibility required-status propagation for radio groups |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/runtime |
7c3fb01227f0 |
none - Wasm GDB-remote debugger RunOne/continue-thread semantics |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebKit/UIProcess |
80922ddfc24c |
none - delegated-zoom origin anchoring math + moving-pinch pan |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/WebCore/rendering |
8e7db40c1610 |
none |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/SaferCPPExpectations |
8fcb04d31876 |
none |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/html |
9e1510e76bcf |
none |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/JavaScriptCore/bytecode |
ac57a2af8c0e |
none |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/runtime |
b7161cda17aa |
none |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/page |
d1179a99deab |
none |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/rendering |
d12fc1298fbd |
none |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/JavaScriptCore/b3 |
e2e0869eaaad |
none - Safer-C++ annotation suppressions and RAII ownership cleanups |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/JavaScriptCore/bytecompiler |
e5f751c78bd0 |
none - replaces MarkedArgumentBuffer with Vector+AssertNoGC in ArrayNode codegen, removes numConstants bookkeeping |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/css |
e64e28917cb4 |
none - monochrome media query resolves main-frame view via virtualView() |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/layout |
eec3a9a6a86a |
none - line-clamp forced-hidden handling generalized from RenderBox to RenderElement |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/rendering |
f0fdd66b6957 |
none - extracts ReplacedElementSizing, adds createNativeImageAsPainted drag-image path |
| ⚪ noise | NotSecurity | 0.12 | low | — | Source/WebCore/html |
f59caaa996fa |
none - notifies AX cache of RenderListBox item changes |
| ⚪ noise | NotSecurity | 0.12 | dev | — | Source/JavaScriptCore/inspector |
fe7b1ac8b3e9 |
none - Web Inspector element selection/hover routing for Site Isolation frames |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebKit/UIProcess |
00a0acf5827c |
none - site-isolation routing of acceptsFirstMouse/windowOrdering to remote frames |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WTF/ |
118667ff8281 |
none - WebKitLegacy mass SaferCPP migration |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/dom |
12c9964c288d |
none - WebCore JS bindings mass SaferCPP migration |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/dom |
143198e9d6cb |
none - simulated clicks dispatch pointer events with mouse-like detail/buttons |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WTF/ |
163c1963d462 |
none - WTF SaferCPP cast hardening (uncheckedDowncast/SUPPRESS_MEMORY_UNSAFE_CAST) |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebKit/Platform |
199bead9df8d |
none - TextExtractionFilter loads precompiled .mlmodelc directly + logging |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/SaferCPPExpectations |
1cff42dc642f |
none - animation SaferCPP protect()/CheckedPtr migration |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/Modules/mediastream |
1ded72f13850 |
none - WebCore-wide SaferCPP auto->RefPtr/Ref migration |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/rendering |
1f9701c40a1a |
none - line-clamp force-hidden boxes skip layout and overflow |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/dom |
20ee911d3d50 |
none - bindings codegen SaferCPP (RefPtr document) + NODELETE |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/css |
2edaa071178a |
none - mass downcast rvalue-overload migration for Ref/RefPtr |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/dom |
6164d9c66ecd |
none - implements the Document-Isolation-Policy web-platform feature |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/heap |
75a1e77857c2 |
none - GC verifier ownership moved Heap->Collector (debug only) |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebKit/CMakeLists.txt |
7f43fa7ebe87 |
none - new WebDriver BiDi input module agent |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/rendering |
8586b1981cad |
none - RenderElement line-clamp bit converted to 2-bit state enum |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/svg |
a8808be837b7 |
none |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/html |
afde8413c9cc |
none |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/WebCore/dom |
b4925b759d58 |
none |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/assembler |
c5cb0e0f45e4 |
none |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/platform |
c85641800591 |
none |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/rendering |
dbdca7545da8 |
none |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/JavaScriptCore/runtime |
e2ffc55c56bd |
none - new divide-and-conquer BigInt toString algorithm ported from V8 |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/layout |
e3e3003de50f |
none - CSS line-clamp:auto clamp-point computation feature/refactor |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/page |
e53a936d1ef3 |
none - threads preventedByPage bool through text-selection gesture IPC |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/svg |
e7766cc21cd4 |
none - implements SVG textPath side=‘right’ attribute |
| ⚪ noise | NotSecurity | 0.1 | dev | — | Source/JavaScriptCore/inspector |
e86e35f4d9dd |
none - Web Inspector grid/flex overlays for cross-origin frame nodes |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebKit/UIProcess |
e8f602e03060 |
none - renames getAllFrameTrees to getAllFrameTreesForSiteIsolationTesting, moves automation to getAllFrames |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebCore/Headers.cmake |
ed90582af3fc |
none - renames URLMatch to QuirkMatchPattern/URLPatternList, rebuilds quirk URL matching |
| ⚪ noise | NotSecurity | 0.1 | low | — | Source/WebGPU/ |
ff2fd63a337d |
none - WebGPU Metal backend C++ API migration (metal() downcasts, std::expected requestDevice) |
| ⚪ noise | NotSecurity | 0.08 | low | — | Source/WebCore/html |
0358f5736d80 |
none - consolidation of HTMLSelectElement button/AX label text |
| ⚪ noise | NotSecurity | 0.08 | low | — | Source/WebCore/Modules |
13f0a6cbad3d |
none - SpatialPortalController anchor resolution refactor |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/dom |
8a311faa00bd |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/layout |
9259b6d6fbd3 |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/rendering |
930a551da22e |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/layout |
96d84d561c57 |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/html |
9b7886d86472 |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/css |
a352da53133b |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/rendering |
abd3e51d2c89 |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/JavaScriptCore/runtime |
b1913f6615d4 |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/css |
b35e6240cfc8 |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/dom |
bcb4d683f08d |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/rendering |
bda67bee9209 |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/layout |
cdfe0c37be22 |
none |
| ⚪ noise | NotSecurity | 0.08 | dev | — | Source/WebCore/animation |
ef6756c8aabd |
none - adds TextStream dump operators for accelerated animation effects |
| ⚪ noise | NotSecurity | 0.06 | dev | — | Source/WebCore/page |
129d3bea76d3 |
none - component-aware path matching for a site quirk |
| ⚪ noise | NotSecurity | 0.06 | dev | — | Source/WebCore/layout |
1700b4a1e543 |
none - grid auto-repeat constraint threading refactor |
| ⚪ noise | NotSecurity | 0.06 | dev | — | Source/WTF/ |
b4363b9b3694 |
none |
| ⚪ noise | NotSecurity | 0.05 | dev | — | Source/WebCore/platform |
0c2a3f82bdd8 |
none - rendering-update scheduling before due timers for first paint |
| ⚪ noise | NotSecurity | 0.05 | dev | — | Source/WebDriver/Session.cpp |
0d1f138acdf6 |
none - WebDriver support for multiple simultaneously pressed char keys |
| ⚪ noise | NotSecurity | 0.05 | low | — | Source/JavaScriptCore/inspector |
15fea1ee0fc8 |
none - Web Inspector FrameDOMAgent + overlay config parser extraction |
| ⚪ noise | NotSecurity | 0.05 | dev | — | Source/WebKit/WebProcess |
1942372a5e7f |
none - post-rendering-update RunLoopObserver for frame completion |
| ⚪ noise | NotSecurity | 0.05 | dev | — | Source/WebCore/testing |
497ff14e6055 |
none - test-only Internals helper |
| ⚪ noise | NotSecurity | 0.05 | dev | — | Source/JavaScriptCore/API |
7c9c2207d0cd |
none - header includes and namespace qualification |
| ⚪ noise | NotSecurity | 0.05 | dev | — | Source/JavaScriptCore/inspector |
a3243e0fce24 |
none |
| ⚪ noise | NotSecurity | 0.04 | dev | — | Source/WebCore/rendering |
113f6ced7d4a |
none - move LineClampUpdater inline impl from header to .cpp |