PatchGap

WebKit Silent-Fix Report — 2026-W34

Window: 2026-08-17 - 2026-08-23 (ISO 2026-W34). Generated by the webkitMon commit hunter (structural scorer v2 → LLM triage → root-cause analysis).

Coverage

  • 267 commits triaged (floor-0 candidate set: every commit scoring ≥0).
  • 47 judged security-relevant; 20 exploitable-grade (isSecurity, confidence ≥0.6, severity high/medium) with full writeups.
  • Non-security in candidate set: 220 (candidate-set false-positive rate 82%).

Columns. Sev — severity (high / medium / low / dev). Conf — the triage model’s confidence (0.00–1.00) that the commit is a genuine security fix. Class — bug class (UAF, OOB, type confusion, race, cross-origin, bypass, …). Every row links to a full page with commit metadata and a side-by-side before/after view; the exploitable-grade commits also carry a full root-cause analysis, PoC, and detection guidance.

Exploitable-grade picks

# Sev Conf Class Component Commit One-liner
1 high 0.90 IntegerOverflow JSC Bytecode 97df94ead028cddcfc21e48ec6f2f72d25ec1662 Unchecked metadata size overflow in UnlinkedMetadataTable::finalize()
2 high 0.90 UAF WebCore ImageLoader d40f4efab0e0cee61e29c8540abff5285bf5275d Use-after-free in ImageLoader::dispatchPendingLoadEvent/dispatchPendingErrorEvent
3 high 0.90 UAF WebCore MutationObserver 9c6099bea06bf812084dc9118bbae1dcda5937a0 Observed node collected during MutationObserver::deliver()
4 high 0.90 TypeConfusion JSC DFG 7711916200dda7e418b321e34493f66a7af2a0b0 NodeMustGenerate wrongly cleared on CheckOverflow ArithAdd/ArithSub in DFG Inc/Dec fixup
5 high 0.90 OOB WebCore PNGImageDecoder 5b391e6d3b14d549908dad2c6695999291313f30 Heap out-of-bounds write in PNGImageDecoder::frameComplete() ICC transform
6 high 0.90 UAF WebCore WebAudio 55d9d9007f54ee61fa38accb59cd88a8d4075847 Use-after-free in MediaElementAudioSourceNode::provideInput on detached iframe
7 high 0.90 TypeConfusion OMG/B3 patchpoint exception stackmap 9f07374e9eb2398ebf629352f5fc0a509ae631b8 Wasm JIT clones patchpoints for calls inside try block, corrupting exception stackmaps
8 high 0.90 TypeConfusion B3 LICM a5fa580c849f0d81096e8650be79392ae1517f59 B3 hoistLoopInvariantValues mishandles control-dependent trapping loads
9 high 0.90 TypeConfusion DFG SpeculativeJIT 8283d4f1273add66f659b203baaae8e56c4fc3f2 DFG Uint32Array load ignores Int32 speculation path producing wrong boxed value
10 high 0.90 Race Wasm BBQ JIT / GC ce60d5d618367a814de46344cb0e45696bf27786 Missing mutatorFence when allocating WasmGC struct with ref fields
11 high 0.90 TypeConfusion Wasm BBQ JIT 958a13ecadda5806cf85cc0b61904b1d6cb6e868 BBQ indirect-call profile update clobbers wasmContextInstancePointer
12 high 0.90 TypeConfusion DFG SpeculativeJIT 3ddc7045b7c5a9ccb6ef09124c7b8efb93527208 DFG SwitchChar releases scrutinee before speculating it is a string
13 high 0.90 OOB BBQ/OMG bounds & null checks 3b9afb2b4f23fc2eb9555835a2ce0c6ebdb26056 Wasm JIT boundary handling: missing bounds check / ref.cast null trap in BBQ/OMG
14 high 0.90 UAF MicrotaskCallCache / Heap deleteAllCodeBlocks 75a9d414a4a8b98d26840162d103eb16227eaeb6 Stale MicrotaskCall entry points after CodeBlock detach (deleteAllCode)
15 medium 0.90 Race WebGPU GPUProcess 6dca6330dba27ff589985db50e5e259f71a44f61 drawIndirect/drawIndexedIndirect clamp shares one per-Buffer scratch slot causing arg race
16 medium 0.90 Bypass EnhancedSecurityTracking 39b67e68ebc2aed8f549fdf73622f8f6c4871647 Enhanced Security state dropped on back/forward reload navigations
17 medium 0.90 Race Worker name StringImpl 3400ff6aa7b63e840b7cecd229e38e2c19e538ae Shared StringImpl for worker names crosses threads (non-atomic refcount)
18 medium 0.90 UAF BaseAudioContext deferred derefs 2c2b96df94cb454c6e58536b16fead32d4dd1de3 Iterator invalidation while draining deferred audio-node deref lists
19 medium 0.90 Bypass WebExtension injected content match patterns 15fa22b107d107d2c48bb99373ac9767dcf1bf62 Extension content injected into denied domains despite exclude patterns
20 medium 0.90 Bypass SameSite cookies / srcdoc iframe c52bbb5187e1602b26568547b57440f196bba56a Srcdoc iframes bypass SameSite Strict/Lax cookie restrictions

Other security-relevant

Sev Conf Class Component Commit One-liner
medium 0.55 OOB WebCore BMP decoder e269e1967d8d2dd0d4b1ba8bedd38900a46b6102
medium 0.55 UAF WebCore IFC Layout 884e3169771bfde0f93c3bc3ed12c55144d5cd04
medium 0.55 LogicError WebCore CSSFontFace 64a55fd574c40d8fda92b4f114d2a2afb9f0ec71
medium 0.55 UAF WebCore SpeechSynthesis 527353138b7cb1b6d6f8b5c8c9fe5bf52c63c266
medium 0.55 OOB WebCore WebCodecs Audio 4fa207d1c8d4a14afbda9ffa02b9070effd52d9b
medium 0.55 LogicError WebKit NetworkResourceLoader cc7a6821b7cceb7cb9e2836a9dfc11a42691683a
medium 0.55 Race SkiaSerializedImageBuffer 1feb6ac19b06a18bee095b204f70551cb22eff3b
medium 0.55 LogicError SingleAnimationRangeEdgeOffset 55c608d2b1b46d1ac0b40d093a8c6b5a69c16907
medium 0.55 CrossOrigin Site Isolation / printing 273837bcb9abb0793a8d7a7002c27572eb37f850
medium 0.55 TypeConfusion Wasm BBQ JIT e88b92e29f0753e644abe33fdbc2b78c051ebf59
medium 0.55 UAF FrameTree teardown 112604f6a167ea78c004e392cd123edde551f2b5
medium 0.55 CrossOrigin NetworkStorageManager site validation df8786e8b6a8fabb2ad9574914a4f33117f8950e
medium 0.55 OOB WebStorageNamespaceProvider 313a4e84e9cc3044d9d5587e807074d0d6240dc1
medium 0.55 LogicError html/parser (adoption agency) e8b1d6b3bee17692f749f06aa2729107a2e3148d
medium 0.55 IntegerOverflow platform/graphics/IntSize 0fd61004f1b1dcb44797e0e0059910b47be12b85
medium 0.55 LogicError process swap / suspended pages c73014505affe2bd1a831719b86068cc07dcde4a
medium 0.55 CrossOrigin CookieJar / Vary:Cookie validation 7d09127ca947791dc0a72109466a9b0433ab898e
medium 0.55 LogicError SourceBufferParserWebM bc0b5db0e5d31ca7a15a2bf334188ed71004e553
medium 0.55 LogicError UIProcess navigation policy / downloads f78e2fb7cfb10417c5a99affaba7fcad58226c52
low 0.55 UAF WebCore GStreamer DesktopPortal 32aac5dacfa53cb1d89423f91f2e49e1210a3952
low 0.55 LogicError WebKit Site Isolation 9c771fce0a906f72dba484655193f91a369f78d3
low 0.55 LogicError RemoteSnapshot drawToBitmap 1603d30438c2628ceb6b413201a1c26b6e5cc192
low 0.55 LogicError SOUP auth credential cache f76f30efcb689ec60174addc19d38b9150b67c69
low 0.55 LogicError Site Isolation frame tree sync 884d0116ea09545d3bebd0d91a834ecc23ab6c31
low 0.55 LogicError WebExtension namespace property check 7684281e4877ed748ef81431c1556cb80db78285
low 0.55 Bypass interaction summary string redaction b56d0c9b157522fba900fc8b8b009b4729fd42de
low 0.55 UAF CanvasBase css canvas clients 6743d4ebb647587a2b5b6ae8df4041490b87eb54