WebKit Silent-Fix Report — 2026-W23
Window: 2026-06-01 - 2026-06-07 (ISO 2026-W23). Generated by the webkitMon commit hunter (structural scorer v2 → LLM triage → root-cause analysis).
Coverage
- 280 commits triaged (floor-0 candidate set: every commit scoring ≥0).
- 55 judged security-relevant; 21 exploitable-grade (isSecurity, confidence ≥0.6, severity high/medium) with full writeups.
- Non-security in candidate set: 225 (candidate-set false-positive rate 80%).
Columns. Sev — severity (high / medium / low / dev). Conf — the triage model’s confidence (0.00–1.00) that the commit is a genuine security fix. Class — bug class (UAF, OOB, type confusion, race, cross-origin, bypass, …). Every row links to a full page with commit metadata and a side-by-side before/after view; the exploitable-grade commits also carry a full root-cause analysis, PoC, and detection guidance.
Exploitable-grade picks
| # | Sev | Conf | Class | Component | Commit | One-liner |
|---|---|---|---|---|---|---|
| 1 | high | 0.90 | UAF | WebKit UIProcess | 9d60567537546eba3b8e490334a06b2fb3ecb0ae |
Use-after-free in ~WebProcessProxy() when replying to pending IPC messages |
| 2 | high | 0.90 | TypeConfusion | WebCore Streams | 96ec73a1e57d67618055237272f866849103669c |
Type confusion in ReadableStream when cancel returns a fake Promise object |
| 3 | high | 0.90 | UAF | WebCore DOM | 934ecdc220856de5f97da087b09923355c2c7414 |
Use-after-free in Node::rootNode via stale m_shadowIncludingRoot |
| 4 | high | 0.90 | Race | WebCore DOM Range | ab488735a47d06ba5753be00ae0212f76e20a5ff |
Data race in Range boundary points during concurrent GC visit causes use-after-free |
| 5 | high | 0.90 | Race | WebCore DOM Range | 621e3bf30e1d188679b927a6ea34c0c8971e020c |
Data race / UAF of RangeBoundaryPoint in Range during concurrent GC visit |
| 6 | high | 0.90 | UAF | WebCore IntersectionObserver | 2757278b899d7543c54534314ddf8d7026ce7349 |
Iterator invalidation of m_observationTargets in updateObservations |
| 7 | high | 0.90 | Race | WebCore DOM/Node | f88c5d9a0c4dee653373dd5fd4d0bd20c9f1706a |
Data race in Node::traverseToOpaqueRoot from concurrent root traversal |
| 8 | high | 0.90 | Race | JSC Atomics/WaiterListManager | 21ab50e40f062d97c1d1eb47f5d42e51bc201203 |
Data race / UAF in WaiterListManager::unregister reading cancellable ticket target |
| 9 | high | 0.90 | UAF | WebCore IndexedDB | 917854a9c245b87b333e23ed4b195505d574a333 |
Use-after-free from using -0.0 as a HashMap key in IndexedDB unique index |
| 10 | high | 0.90 | TypeConfusion | JSC Wasm OMG/B3 | c18d1e3571f490235aa624c1593e7d1289ea7ba6 |
Wasm OMG tail-call patchpoint fails to clobber late pinned registers |
| 11 | high | 0.90 | UAF | JSC Baseline JIT | 1cdc540e6ebee5192b5b5d4fc0202b8bfd37eece |
Missing write barrier in baseline OpDelById/OpDelByVal |
| 12 | high | 0.90 | TypeConfusion | JSC Bytecode/IC | 73689f5430825ecffb614dbcce8e6575dfea3d50 |
GetByStatus constant-folds prototype load on dictionary structure that can be silently shadowed |
| 13 | high | 0.90 | CrossOrigin | NetworkProcess IPC | 841ad59485b9991f47dd40dc1c9652bc714f7231 |
CORS bypass via unvalidated SetCORSDisablingPatterns IPC from web process |
| 14 | medium | 0.90 | Bypass | WebCore FrameLoader/CSP | c1ab79ebcc0fff886aad0217b9d1a9b8f20a20cf |
CSP upgrade-insecure-requests not applied to cross-origin iframe-to-top navigations |
| 15 | medium | 0.90 | CrossOrigin | WebCore View Transitions | cc6b337ba1540c4c071c16103cd2c0fdb8e32564 |
CSP sandbox (opaque origin) does not block cross-document view transition state transfer |
| 16 | medium | 0.90 | CrossOrigin | WebKit NetworkProcess MessagePort | da44cdb89cd768f800e38ca1f675b723b70bb575 |
Compromised WebContent process can take pending MessagePort messages for unentangled ports |
| 17 | medium | 0.90 | CrossOrigin | WebKit WebFrameProxy AppBadge | 675c62d66e3cfa45f2a6206bdd5f1ca9fd59cc09 |
App Badge origin spoofing from window contexts |
| 18 | medium | 0.90 | Bypass | WebKit UIProcess Navigation | 4b574bf8287b6b5783596850d8a17f300b75a7a2 |
Downloads proceed before Safe Browsing check completes |
| 19 | medium | 0.90 | CrossOrigin | NetworkProcess Download | e30ca29fe97301994a1d6c66ab56fcc1aff66d3f |
Missing first-party cookie access validation in download IPC handlers |
| 20 | medium | 0.90 | CrossOrigin | FrameLoader cookies | 093f34607a3e8c6bdf6fbe178a68ca96ecc067c6 |
SameSite=Strict cookies leak cross-site when initiator omitted |
| 21 | medium | 0.90 | CrossOrigin | JSC Promises/Realms | 51cc3feb729804866ae63510d837f4df674bbc59 |
Promise jobs must not run with the realm of a cross-realm settle site |
Other security-relevant
| Sev | Conf | Class | Component | Commit | One-liner |
|---|---|---|---|---|---|
| medium | 0.55 | OOB | WebCore Layout | ca8c809f1e71553a22215a67fe9be1d05114e6d6 |
|
| medium | 0.55 | Bypass | WebKit UIProcess SafeBrowsing | 0e4040cd014e6b637fe4390c547e1ab82bbf18d7 |
|
| medium | 0.55 | LogicError | WebCore DOM | 4f393fd202e3aae8e78552bb3dd8473b10fa7113 |
|
| medium | 0.55 | LogicError | WebKit NetworkRTC | 8aab904f7092297ec74b591486cc700379fe61d5 |
|
| medium | 0.55 | LogicError | WebCore Fetch | a3f3cda54a85059955df2848f0e8ef77a850c2a8 |
|
| medium | 0.55 | LogicError | WebCore Rendering | bf80e3eedd686c0fe2ecce39b3143e6279a89103 |
|
| medium | 0.55 | OOB | JSC Temporal ISO8601 | d58bad697e50a0bda1ff67669bb4cf9e1f78662e |
|
| medium | 0.55 | CrossOrigin | WebKit Site Isolation | f8acb9cb819c1f8ae56c81b5e5076403a6b12a5b |
|
| medium | 0.55 | LogicError | WebKit Site Isolation | fec133e2eaadbecd135945e4090f561497e055af |
|
| medium | 0.55 | UAF | WebCore MessagePort | 67117c4975bb291a8775a61ee3c19dfe13e50690 |
|
| medium | 0.55 | OOB | WebCore Media/H264 | c195e933ce50176cc8364190abe293b5a859836c |
|
| medium | 0.55 | UAF | WebKit UIProcess/WebPageProxy | 1682be99490a2f051957f351a9d44782b4c579f8 |
|
| medium | 0.55 | OOB | WebCore MIMESniffer | 1c9e3e8e8bcdd1531787cbf782fbf8020f3340d6 |
|
| medium | 0.55 | Bypass | WebKit WebProcessProxy origin check | 89f18277fe742a66605ffb4401a3732ae4bff55b |
|
| medium | 0.55 | UAF | WebCore GStreamer MediaPlayer | bb7ef44f57a19f532be31fbcaef9c02ebdc51fa5 |
|
| medium | 0.55 | OOB | Temporal ISO8601 parser | 544a3bff9b31c9ba947710eac79486e43d053c11 |
|
| medium | 0.55 | CrossOrigin | Site Isolation BackForwardCache | 00a2a6621815015a6a81b1d6bcf2e82666de1f45 |
|
| medium | 0.55 | UAF | Site Isolation BFCache | 5b5081adba8f0891b114ba01a843fbbfdb6b7cd7 |
|
| medium | 0.55 | Bypass | Site Isolation History | ceb4d817be51a2f1fd44eb46cd575598358abbdc |
|
| medium | 0.55 | SandboxEscape | Entitlements/Sandbox | 3f1ad2f2e5cc888d49b13d08f41d2b16a33f1be4 |
|
| medium | 0.55 | LogicError | WebCore Accessibility AXObjectCache | 28e2def3391fcf13871b39813d3c2fa8d91d9a06 |
|
| low | 0.55 | LogicError | WebKit WebPage | 6a4511bc5935267f5bc58b34616bc9e244ec66c4 |
|
| low | 0.55 | LogicError | WebCore Streams | 64ad3f36af0d8f25efc49f0390c7a3732e99c825 |
|
| low | 0.55 | LogicError | WebCore Streams | 846badc3c41ca797dd2d5980061ad32c157638f5 |
|
| low | 0.55 | Other | JSC runtime | 3825a1a93bbf70dba2406c75919f5d5049a18607 |
|
| low | 0.55 | Other | WebCore Style/AnchorPosition | f7a8a5c0476af3f6349707dad1fd026c80eaf763 |
|
| low | 0.55 | UAF | WebCore CookieStore | cc35e71c66143f1777eb577bd3b81917356bd514 |
|
| low | 0.55 | Other | WebCore WebRTC/GStreamer | afa9356bdfb252a174b3a0d53184c2ec62a1bcba |
|
| low | 0.55 | LogicError | UIProcess Permissions | e118db06408d11b659613936beccef24dea1421e |
|
| low | 0.55 | Other | Fetch | 349e1d8549509c1925480da94432d2212d23903a |
|
| low | 0.55 | Other | WebCore HID (mac) | dc24f31e117d804296b6b5a1fa56014a6e9fe21a |
|
| low | 0.55 | LogicError | Accessibility iOS | b9f72089660743af40868166a591f2ce0469e760 |
|
| low | 0.55 | TypeConfusion | WebCore TextRecognition Cocoa | 2a8ad89393e742e18a6df250b4f3fd579b0ead4e |
|
| low | 0.55 | LogicError | WebKit XPCService iOS | 9682d18068ac9fe96d17f82577f5c3afb803355e |