PatchGap

WebKit Silent-Fix Report — 2026-W22

Window: 2026-05-25 - 2026-05-31 (ISO 2026-W22). Generated by the webkitMon commit hunter (structural scorer v2 → LLM triage → root-cause analysis).

Coverage

  • 255 commits triaged (floor-0 candidate set: every commit scoring ≥0).
  • 71 judged security-relevant; 52 exploitable-grade (isSecurity, confidence ≥0.6, severity high/medium) with full writeups.
  • Non-security in candidate set: 184 (candidate-set false-positive rate 72%).

Columns. Sev — severity (high / medium / low / dev). Conf — the triage model’s confidence (0.00–1.00) that the commit is a genuine security fix. Class — bug class (UAF, OOB, type confusion, race, cross-origin, bypass, …). Every row links to a full page with commit metadata and a side-by-side before/after view; the exploitable-grade commits also carry a full root-cause analysis, PoC, and detection guidance.

Exploitable-grade picks

# Sev Conf Class Component Commit One-liner
1 high 0.85 Race WebCore XMLHttpRequest/GC a814080321 UAF/race: XHR responseXML/upload mutated on main thread while GC thread visits opaque roots; adds m_gcLock
2 high 0.85 Race WebCore Streams ad57b514bb UAF/race: ReadableStreamDefaultReader m_stream visited on GC thread while released on main; adds m_streamLock
3 high 0.85 Race WebCore Streams 597af50a64 UAF/race: ReadableStreamBYOBReader m_stream accessed on GC thread while mutated on main; adds m_streamLock
4 high 0.85 UAF WebCore Shadow DOM SlotAssignment 20beac1f6e UAF in NamedSlotAssignment::resolveSlotsAfterSlotMutation; reassign slots when invalid before iterating
5 high 0.85 UAF JSC Wasm Table 36a3e59bad Wasm Table.grow with non-null funcref default left slot half-initialized; GC freed live wrapper, table.get dangling
6 high 0.85 TypeConfusion JSC FTL OSR eba64ef44d FTL Phantom array rematerialization used wrong structure after having-a-bad-time; ArrayStorage vs contiguous mismatch
7 high 0.85 TypeConfusion JSC FTL OSR a82eb9dd7f FTL rematerialization dropped double-array holes and hasHoles count during bad-time, bypassing prototype accessors
8 high 0.85 OOB JSC TypedArray c8525868de TypedArray sort used cached length instead of span size; parallel SharedArrayBuffer grow could OOB
9 high 0.85 OOB WebCore Crypto (SubtleCrypto) d3de21e23b Add bounds checks to platformImportSpki/platformImportPkcs8 preventing over-read when index==keyData.size()
10 high 0.85 TypeConfusion JSC DFG 78c04ea7a1 Validate initial object structure in DFG tryEnsureAbsence before caching a property-miss condition
11 high 0.85 UAF JSC Interpreter 32f1bfb841 Defer GC while direct-eval CacheLookupKey holds a raw StringImpl from a rope fiber that flattening can free
12 high 0.80 UAF WebCore ScrollerMac a926a679cf UAF in WebScrollbarPartAnimationMac setCurrentProgress; ScrollerMac moved to ThreadSafeWeakPtr with null-check
13 high 0.80 UAF WebCore forms date/time input 869d5c5531 UAF in BaseDateAndTimeInputType::didChangeValueFromControl; null-check element() instead of asserting
14 high 0.80 TypeConfusion JSC DFG 177d2cad35 DFG tryEnsureAbsence accepted dictionary structures; a ’then’ added later went undetected, breaking Promise.resolve
15 high 0.80 TypeConfusion JSC B3 81aa535db3 B3CanonicalizePrePostIncrements dominance analysis mishandled non-dominated uses, producing a miscompile
16 high 0.80 IntOverflow ANGLE Metal backend 0fe9ff8c67 ANGLE Metal syncDirtyAttrib crashed on OOB vertex attribute offset; vertex-count math hardened with CheckedNumeric
17 high 0.80 CrossOrigin WebKit NetworkProcess (cookies) fb75caed1b Validate cookie.domain and url match firstParty in setRawCookie and guard NSHTTPCookie creation exceptions
18 high 0.75 UAF JSC FTL e638840dd2 Fix GC safety for sunk contiguous array materialization in FTL by keeping element cell values live across allocation
19 high 0.72 UAF JSC Wasm JSWebAssemblyInstance 76b3468621 Unregister/tear down Wasm InstanceAnchor at the prologue of JSWebAssemblyInstance destructor to avoid UAF
20 high 0.72 UAF JSC TypedArray prototype a271abef22 Fix vector caching in TypedArray.prototype.forEach so a transitioning/reallocating buffer isn’t read via a stale pointer
21 high 0.70 OOB JSC InlineCacheCompiler 34669c802f Move DataView null-vector check outside IC register save/restore to avoid stub stack desynchronization
22 high 0.65 OOB JSC ClonedArguments 5099a4a895 Fix incorrect loop condition (length→length+offset) in ClonedArguments::copyToArguments with non-zero offset
23 medium 0.80 IntOverflow libwebrtc H264 AVC parser 86f9503e09 Reject AVC where size <= NALU type size in ComputeH264InfoFromAVC to fix integer underflow crash on attacker data
24 medium 0.75 Bypass WebCore CSP / WebAssembly 4003087f20 CSP wasm-unsafe-eval not enforced during Wasm byte compilation; Module() now blocked like Instance()
25 medium 0.75 Bypass WebCore LocalDOMWindow postMessage cfbce92003 postMessage relay indefinitely extended user-gesture token lifetime; now expires forwarded token
26 medium 0.75 Bypass WebKit Storage Access / Tracking Prevention 5021f999fe No-gesture requestStorageAccess() rejection fabricated user interaction that silently granted storage access under the opener
27 medium 0.70 UAF WebCore Navigation/Loader 8e3ad95fd1 Crash in HistoryController::updateForCommit when navigation.reload() runs during pageswap; now rejected
28 medium 0.70 Other WebCore Font / GPU IPC e57f9072af FontPlatformSerializedAttributes::toCFDictionary crashed on null palette entries from IPC; now skipped
29 medium 0.70 UAF WebCore render tree form controls 4f359a0df3 Crash recreating option::checkmark; advance beforeChild before destroying existing pseudo-element
30 medium 0.70 Race WebCore PlatformScreen 08911bd034 Concurrent screenData HashMap access caused MTE crashes; routed through PlatformScreen singleton
31 medium 0.70 CrossOrigin WebKit UIProcess site-isolation 1ad0d2a7c3 Cross-process page identity confusion in didPostMessage; Close now carries explicit page identifier
32 medium 0.70 Bypass WebCore CSP site-isolation 888c80c640 CSP upgrade-insecure-requests skipped when a cross-process iframe navigates the top frame; now plumbed to UIProcess
33 medium 0.70 UAF WebKit UIProcess iOS forms 7b904b1187 Crash in WKDateTimePicker removeDatePickerPresentation; protect() controls before dismiss/edit callbacks
34 medium 0.70 Race WebCore GPUCanvasContextCocoa cf20d123b3 Fix concurrent HashMap access in GPU canvas EDR headroom updates that caused MTE crashes
35 medium 0.65 UAF WebKit UIProcess RemoteLayerTree 2b7262df1a UI-process crash under DisplayLink callbacks; dtor now stops display links via WeakPtr process pool
36 medium 0.65 TypeConfusion JSC DFG CSE 1f4e4caab0 DFG StringAt did not include arrayMode in CSE, letting in-bounds/OOB variants be merged incorrectly
37 medium 0.65 CrossOrigin WebCore SpeechSynthesis 35c8316c38 Cancel SpeechSynthesis on suspend/stop so utterance audio does not leak to the next page on navigation
38 medium 0.65 UAF WebKit Site Isolation (WebProcessPool) 6512004572 Hold a shutdownPreventingScope on the reused process across addAllowedFirstPartyForCookies callback
39 medium 0.60 Other JSC FTL/B3 Air 1b422914d5 FTL stack-overflow check moved to prologue before frame allocation
40 medium 0.60 UAF WebKit UIProcess Inspector site-isolation bafdda395e Inspector proxying agent pinned process refs to avoid null/leak when removing receivers for swapped-out processes
41 medium 0.60 UAF WebKit UIProcess WKWebView iOS 8ea9912036 Crash in _dispatchSetViewLayoutSize when client overrides setFrame; null-check _page
42 medium 0.60 Race WebCore GStreamer WebRTC 8af0c2d1ea GStreamer WebRTC ICE agent used after close in async configure/incoming-data callbacks; added isClosed guards
43 medium 0.60 LogicError WebCore DOM ContainerNode 4c43686c30 ContainerNode::replaceAll short-circuit skipped removeAllChildren for Element inserts, leaving stale children
44 medium 0.60 Bypass WebCore LocalDOMWindow postMessage 4f82ed3499 postMessage user-gesture token expiry fix (part of the series, adds duplicate expiry guard)
45 medium 0.60 Bypass WebCore LocalDOMWindow postMessage 2050ddd586 postMessage user-gesture token expiry fix (series commit with duplicated expiry guard)
46 medium 0.60 UAF JSC bytecode ExpressionInfo 799e388d2e ExpressionInfo::Encoder::adjustInstPC takes an index instead of a pointer to survive vector reallocation
47 medium 0.60 TypeConfusion JSC B3/Air fa0214fe9a Fix AirFixObviousSpills modeling of early defs (clobber early defs before late defs)
48 medium 0.60 Other JSC Wasm builtins 57df341619 Add missing exception check after rope string resolution in WebAssembly builtins
49 medium 0.60 Bypass WebKit NetworkProcess IPC 479f2b4542 Replace abusable RELEASE_ASSERT(identifier) with MESSAGE_CHECK in scheduleResourceLoad
50 medium 0.60 Other JSC IteratorOperations b67282ad89 Add missing exception check in forEachInIteratorProtocol Set-iterator fast path
51 medium 0.60 Race JSC JSLock aed1fddc0b Make JSLock m_hasOwnerThread atomic with acquire/release to fix cross-thread data race
52 medium 0.60 CrossOrigin WebKit Site Isolation / bfcache fd143209a4 bfcache restore of a page with a cross-site iframe left iframe process’s top URL stale, resolving first party for cookies to the wrong site

Other security-relevant

Sev Conf Class Component Commit One-liner
medium 0.55 OOB JSC YARR RegExp 7663d811d0
medium 0.55 LogicError JSC DFG OSR exit 4e802a14ca
medium 0.55 Other JSC StringPrototype 18a2c9a100
medium 0.50 TypeConfusion JSC DFG allocation sinking cdfa73fdc3
medium 0.50 TypeConfusion JSC LiteralParser 09c07d2796
low 0.55 UAF WebCore SVG (SVGFontFace) 33448fd684
low 0.55 OOB bmalloc libpas enumerator ed57dc0915
low 0.50 LogicError WebCore TextExtraction 55bbd269b7
low 0.50 SandboxEscape WebKit GPUProcess sandbox (macOS) 083c7393fe
low 0.45 LogicError WebCore scroll-snap 1aba36b70e
low 0.45 LogicError JSC iterator/Set prototype ed0f115abf
low 0.45 LogicError JSC JSArray toPrimitive 8a7e39c2bf
low 0.45 Bypass WTF URL/IDN 8449fc1aac
low 0.45 UAF WebCore editing Cocoa 1ea0492626
low 0.40 Other WebKit SpeechRecognitionServer IPC 5db4d93144
low 0.40 UAF WebKit UIProcess drag/sandbox 5f39d2e310
low 0.40 Other WebKit ModelProcess IPC 69ff7c4b91
low 0.40 LogicError JSC ArrayPrototype join f181acea44
low 0.40 UAF WebCore graphics text b88376b534