WebKit Silent-Fix Report — 2026-W21
Window: 2026-05-18 - 2026-05-24 (ISO 2026-W21). Generated by the webkitMon commit hunter (structural scorer v2 → LLM triage → root-cause analysis).
Coverage
- 228 commits triaged (floor-0 candidate set: every commit scoring ≥0).
- 64 judged security-relevant; 28 exploitable-grade (isSecurity, confidence ≥0.6, severity high/medium) with full writeups.
- Non-security in candidate set: 164 (candidate-set false-positive rate 71%).
Columns. Sev — severity (high / medium / low / dev). Conf — the triage model’s confidence (0.00–1.00) that the commit is a genuine security fix. Class — bug class (UAF, OOB, type confusion, race, cross-origin, bypass, …). Every row links to a full page with commit metadata and a side-by-side before/after view; the exploitable-grade commits also carry a full root-cause analysis, PoC, and detection guidance.
Exploitable-grade picks
| # | Sev | Conf | Class | Component | Commit | One-liner |
|---|---|---|---|---|---|---|
| 1 | high | 0.90 | TypeConfusion | JSC DFG | 1aeca6948c |
DFG AI/prediction claimed SpecObjectOther for ArraySortCompact result which is actually a JSCellButterfly, a disjoint wrong type proof |
| 2 | high | 0.90 | CrossOrigin | WebKit NetworkProcess IndexedDB | d85455322d |
IndexedDB IDs not validated against sending IPC connection; MESSAGE_CHECK added to prevent data leakage |
| 3 | high | 0.85 | OOB | libaom AV1 encoder | 3758417301 |
Use crop dimensions in av1_copy_and_extend_frame to avoid heap overflow when size_align > display size |
| 4 | high | 0.82 | UAF | WebCore Media (MSE AVFObjC) | 4193d2c83f |
MediaPlayerPrivateMediaSourceAVFObjC dtor revokes WeakPtrs to stop KVO error callback re-entering a half-destroyed object |
| 5 | high | 0.80 | Bypass | WebCore CSP | 9a19d07c4f |
ContentSecurityPolicySource::pathMatches() didn’t normalize percent-encoded traversal, letting %2F..%2F escape a script-src path allow-list |
| 6 | high | 0.70 | TypeConfusion | JSC DFG | c415e39f48 |
DFG private-tmp mechanism prevents inner/outer inlined Array.sort comparators from aliasing tmp slots and corrupting data |
| 7 | high | 0.70 | UAF | JSC DFG/FTL | 87b4375777 |
OSR exit ScratchBuffers holding live values weren’t published to the collector, so the GC could free objects still referenced |
| 8 | high | 0.65 | TypeConfusion | JSC bytecode/DFG | b07dca9615 |
GetByStatus::computeFor walked the prototype chain for a direct property access, mis-informing the JIT |
| 9 | high | 0.65 | OOB | JSC DFG/FTL | 59a20ddcb9 |
ObjectDefinePropertyFromFields overran the ABI’s argument-register budget; now uses a scratch buffer |
| 10 | medium | 0.88 | Bypass | WebKit WebPageProxy | 23b15df9eb |
didSameDocumentNavigationForFrame accepted arbitrary URL; MESSAGE_CHECK enforces same protocol/host/port |
| 11 | medium | 0.78 | CrossOrigin | WebKit Site Isolation | e5c4d1be15 |
Site Isolation: new RemoteFrame no longer seeded with dying LocalFrame’s stale FrameTreeSyncData, closing a transient same-origin window |
| 12 | medium | 0.75 | UAF | WebCore mediastream/WebRTC | 02e76c68f6 |
Remove audio/video track sink before derived members destruct to stop OnData/OnFrame touching freed state |
| 13 | medium | 0.75 | UAF | WebCore AVFoundation media | 8c860928af |
setTimeObserver stored the callback in a member that a re-entrant reinstall could free mid-call; now captures it in the block |
| 14 | medium | 0.72 | TypeConfusion | JSC DFG | 7429d22f2b |
Reorders emitExitOK before processSetLocalQueue for inlined array sort comparator to fix DFG CPS/OSR-exit state |
| 15 | medium | 0.70 | CrossOrigin | WebCore ResourceLoadStatistics | d6c7e00d0a |
Requests from about:blank popups now honor third-party cookie blocking instead of leaking first-party cookies |
| 16 | medium | 0.70 | UAF | WebKit IPC TransferString | cc28449d96 |
IPC TransferString::release fixes GCC use-after-move where the backing span was read after its memory was moved into the lambda |
| 17 | medium | 0.70 | UAF | WebCore CSS JIT (:has) | b32bca6755 |
:has() argument cache iterated the original selector list while the JIT baked pointers into cached data that outlives it; now iterates the cached copy |
| 18 | medium | 0.70 | Race | JSC RegExp/YARR | dcf25ed3c9 |
RegExp::byteCodeCompileIfNecessary took cellLock and restricted bytecode compilation to the mutator; compiler thread bails if absent |
| 19 | medium | 0.68 | TypeConfusion | JSC DFG | 953bc0380f |
Inserts a missing ExitOK node after constant folding perform-promise-then so OSR exit state stays valid |
| 20 | medium | 0.66 | Bypass | WebCore DOM Element | fc1ef83eae |
Simulated click from an untrusted underlying event is now sourced as Bindings, so label.click() can’t trigger trusted-only behavior (haptics) |
| 21 | medium | 0.62 | CrossOrigin | WebAuthn / Site Isolation | 073bf48042 |
WebAuthn scopeAndCrossOriginParent walks frame tree via RemoteFrames so cross-origin ancestor checks hold under site isolation |
| 22 | medium | 0.62 | Race | WebKit NetworkProcess WebRTC | 7a310eed9f |
WebRTC TCP socket queue switched from CONCURRENT to SERIAL, eliminating a data race on socket state |
| 23 | medium | 0.62 | Bypass | WebCore CSS Values attr() | b4e7e8bd27 |
CSS attr() aligns with disallowing <url> type, closing an attr-taint bypass that let untrusted attribute data form url() references |
| 24 | medium | 0.60 | UAF | WebCore WebAudio | ed04ff4067 |
AudioContext no longer calls document->removeAudioProducer during teardown, moving it to stop() to avoid touching a dying Document |
| 25 | medium | 0.60 | OOB | bmalloc libpas | ba26b52421 |
Add real PROT_NONE guard page at front of compact-heap reservation so a zero compact-ptr deref faults deterministically |
| 26 | medium | 0.60 | Bypass | WebKit NetworkProcess / Site Isolation | cd11ac52db |
m_allowedFirstPartiesForCookies wasn’t restored for subframe processes after a network-process crash, weakening cookie partitioning |
| 27 | medium | 0.60 | LogicError | WebKit GPUProcess WebRTC | 2feb5ed7bc |
LibWebRTCCodecsProxy now MESSAGE_CHECKs that a decoder/encoder identifier isn’t already registered before creating |
| 28 | medium | 0.60 | TypeConfusion | JSC DFG/FTL | fb8bfead60 |
DFG mis-modeled side effects of Spread(SetObjectUse), a JIT-soundness bug |
Other security-relevant
| Sev | Conf | Class | Component | Commit | One-liner |
|---|---|---|---|---|---|
| medium | 0.55 | UAF | WebKit IPC | 825d9df307 |
|
| medium | 0.55 | Bypass | WebCore History (sandbox/unique origin) | 774fe6ba2f |
|
| medium | 0.55 | UAF | JSC Heap / Wasm GC | d55bf0c070 |
|
| medium | 0.55 | Bypass | WebKit ContentExtensions | 7d28e39dfc |
|
| medium | 0.55 | UAF | WebCore animation | 9b473b0e91 |
|
| medium | 0.55 | SandboxEscape | WebKit UIProcess / Site Isolation | 3c5a9e4f2e |
|
| medium | 0.50 | UAF | WebCore DOM (CollectionIndexCache) | 958ef3d92e |
|
| medium | 0.50 | Other | WTF OSAllocator (Windows) | 912cfd18d9 |
|
| medium | 0.50 | Other | JSC runtime | e7c63753e1 |
|
| medium | 0.45 | LogicError | WebM media source | 57e44bb6ce |
|
| low | 0.60 | UAF | WebKit UIProcess/mac | 63ac45d3bc |
|
| low | 0.55 | CrossOrigin | WebKit WebExtensions | 97721a8704 |
|
| low | 0.55 | CrossOrigin | WebCore DOM Element (GTK) | f5376181a6 |
|
| low | 0.55 | OOB | libvpx VP9 encoder (WebRTC) | 53c3a3a59a |
|
| low | 0.55 | LogicError | WebKit NetworkProcess IPC | 84a08d4a5b |
|
| low | 0.55 | MemoryLeak | WebKit Web Inspector / Site Isolation | 0cf61b7a19 |
|
| low | 0.50 | UAF | WebKit NetworkProcess storage | 113cf2c7cf |
|
| low | 0.50 | CrossOrigin | WebCore bindings/Site Isolation | cbe41ae484 |
|
| low | 0.50 | OOB | ANGLE (WebGL) | 1694417658 |
|
| low | 0.45 | UAF | WebCore rendering/layout | 537cc2c75c |
|
| low | 0.45 | LogicError | WebKit UIProcess / Site Isolation | 0a6b5cd60b |
|
| low | 0.45 | LogicError | WebCore text-extraction | e558364e9e |
|
| low | 0.45 | LogicError | WebCore rendering/layout | 5e2525e60a |
|
| low | 0.45 | LogicError | WebCore RenderGrid | 13d9bbd572 |
|
| low | 0.42 | UAF | WebKit UIProcess iOS | 69d300842d |
|
| low | 0.42 | LogicError | WebCore Service Workers | 3bce213c8a |
|
| low | 0.40 | LogicError | WebKit UserContent / Site Isolation | 62fb864bff |
|
| low | 0.40 | OOB | WebKit UIProcess back/forward list | b8c7728535 |
|
| low | 0.40 | UAF | WebCore Workers | 52162f9781 |
|
| low | 0.40 | Bypass | WebKit XPCService (iOS) | c0c27847a6 |
|
| low | 0.40 | LogicError | WebCore platform input | a02317c784 |
|
| low | 0.40 | LogicError | WebCore layout/grid | e9a9f1b34e |
|
| low | 0.40 | OOB | WebCore page/snapshot | f4ce4a791d |
|
| low | 0.40 | SandboxEscape | WebKit GPUProcess sandbox | 9850353d12 |
|
| low | 0.40 | Bypass | WebCore HTML/XML fragment parsing | b9e630270a |
|
| low | 0.35 | Other | JSC Wasm | d8b63073f0 |