PatchGap

WebKit — 2026-W37

Clone-free silent-fix hunt over WebKit (GitHub-sourced), 2026-09-07 → 2026-09-13. Every candidate below is cherry-picked from the week’s merged Source/ commits, triaged on the patch-now / watch / noise ladder, given a full root-cause writeup, and put through independent adversarial verification — the same bar as the Chrome weekly reports.

This week. 79 candidates — 13 patch-now (RCE-class, attacker-reachable in default config), 20 watch (security-relevant but gated / weaker primitive / unproven), 46 noise, 0 duplicate. 7 root-caused · 7 tier-2 verified.

Candidates

Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.

Verdict Class Conf Sev CVSS Component Commit Primitive
🔴 patch-now · ✔︎verified UAF 0.85 high — Source/WebCore/platform d4aabfbeb55f Cross-thread UAF: m_private (MediaPlayerPrivateInterface) freed on main thread while the audio render thread reads it via audioSourceProvider()
🔴 patch-now · ✔︎verified UAF 0.82 high — Source/WebCore/html fe938b0a2301 Stale FontSelectorClient pointer from by-value FontProxy copied into Vector that relocates
🔴 patch-now Spoofing 0.8 medium — Source/WTF/ 2ae84d79b1af compromised WebContent passing an arbitrary URL to ProvisionalPageProxy::didStartProvisionalLoadForFrame (provisional/address-bar URL spoof)
🔴 patch-now · ~plausible OOB-read 0.8 high — Source/WebGPU/ 5c003980c0fe A render bundle’s indexed indirect-draw ICB slot reused on equal generations let an index buffer mutated after baking feed out-of-bounds vertex indices to the GPU.
🔴 patch-now · ~plausible OOB-write 0.78 high — Source/JavaScriptCore/runtime ae97aa471a12 Out-of-bounds read/write on JSArray butterfly in fastCopyWithin when vectorLength < length
🔴 patch-now PolicyBypass 0.72 medium — Source/WebKit/UIProcess 173261c80c9a compromised WebContent process forging transient activation to obtain clipboard paste access via requestDOMPasteAccess
🔴 patch-now · ~plausible OOB-write 0.65 high — Source/WebGPU/ 77acddc2cf45 Compressed-texture repack in Queue::writeTexture lacked the per-row/per-image bounds checks that the hardened path adds, risking out-of-bounds buffer access during the repack copy.
🔴 patch-now UAF 0.62 medium — Source/WebCore/platform d147fe73cf32 Use-after-free: AudioHardwareListener held its Client by raw reference and called into it after the client was destroyed
🔴 patch-now Race 0.6 medium — Source/WebKit/UIProcess 0ccf17b18a16 off-main-thread access to WebPageProxy::attachmentForIdentifier / m_attachments from the item-provider file callback
🔴 patch-now · ✔︎verified UAF 0.6 high — Source/WebGPU/ 70e05bc9fbbf GPU command buffer / referenced resources could be freed while a committed Metal command buffer was still in flight at instance teardown.
🔴 patch-now · ✔︎verified OOB-read 0.6 high — Source/WebGPU/ 870a585cde03 copyBufferToTexture/copyTextureToBuffer split-copy loop assumed blockHeight==1, so for block-compressed formats the per-row offset (y*bytesPerRow) over-advanced into out-of-bounds buffer memory.
🔴 patch-now Spoofing 0.6 medium — Source/WebKit/UIProcess d4b8cb8d2eef Modal JS dialog shown on behalf of a frame no longer in the displayed frame tree (stale/detached-frame dialog)
🔴 patch-now UAF 0.6 medium — Source/WebCore/platform fb20d4d63ba2 Dangling-reference use of a destroyed PlatformSpeechSynthesizerClient from async platform speech callbacks
🟡 watch PolicyBypass 0.55 medium — Source/WTF/ 8eb608658b83 WebRTC DNS resolution was performed without a policy gate, allowing mDNS/relay-bypass behavior that can expose local IPs.
🟡 watch Race 0.55 medium — Source/WebCore/css b982ebd3147d Unlocked read of CheckedPtr/Ref members (m_track, m_ownerNode, m_current, m_element) on parallel GC marking threads racing main-thread mutation
🟡 watch InputValidation 0.55 medium — Source/WebCore/Modules e410d5cb1d2c WebCodecs video encoder config accepted width/height beyond 32767 (potential integer-overflow/OOB in codec backend)
🟡 watch UAF 0.5 medium — Source/JavaScriptCore/runtime 2c0010b8b5f1 FinalizationRegistry dead registrations keyed on a collected unregister token not swept during GC finalizeUnconditionally
🟡 watch InputValidation 0.5 medium — Source/WebKit/UIProcess 436386a065b7 WebContent sending invalid/unset animation UUIDs in TextAnimationData to WebPageProxy::addTextAnimationForAnimationID
🟡 watch Spoofing 0.5 low — Source/WebCore/loader a37a6505759f A page could focus/raise a named target window via createWindow() without a transient user activation.
🟡 watch PolicyBypass 0.5 medium — Source/WebKit/UIProcess acb9b59d02a8 Provisional (uncommitted) process could trigger arbitrary WebPageProxy sync message handlers
🟡 watch OOB-read 0.45 low — Source/WebCore/platform 560f0ec35828 Cert-chain loop could read past SecTrustCopyCertificateChain array or deref a null chain when its count disagreed with SecTrustGetCertificateCount().
🟡 watch OOB-read 0.45 medium — Source/JavaScriptCore/dfg 5d1761dffb00 String.prototype.at/codePointAt DFG nodes lacked SSA-phase bounds-check lowering that StringCharCodeAt had.
🟡 watch InputValidation 0.45 low — Source/JavaScriptCore/jit a371ed314175 IPC-decoded UUID could be constructed with the reserved empty/deleted sentinel values, previously only caught by a RELEASE_ASSERT (process abort).
🟡 watch UAF 0.45 medium — Source/WebCore/platform f90b4eaa2206 WeakPtr parent/this dereferenced across async main-runloop callbacks without holding a strong reference for the call’s duration
🟡 watch IntegerOverflow 0.42 medium — Source/JavaScriptCore/runtime f52d0e486a0e JSBigInt size/bounds invariants and int32_t bit-count casts hardened against overflow/OOB (truncateToNBits/truncateAndSubFromPowerOfTwo, cachedMod, parseInt)
🟡 watch Race 0.4 low — Source/WebCore/platform 42ca5cc802a1 data races on MockRealtimeVideoSource m_preset/m_startTime/m_elapsedTime/m_deviceOrientation between caller and capture run-loop threads
🟡 watch UAF 0.4 low — Source/WebCore/dom 7737c68ff271 Remote intersection observers were not disconnected at Document teardown, potentially leaving them registered against a destroyed document.
🟡 watch UAF 0.4 low — Source/JavaScriptCore/wasm 92a274ec73ed findBreakpoint() returned a raw Breakpoint* into a HashMap value that could dangle if the map mutated while the pointer was held.
🟡 watch OOB-write 0.4 medium — Source/JavaScriptCore/runtime 9e61914f4c44 BigInt digit-buffer arithmetic (karatsuba/divideSchoolbook/shifts/spanCopy/createFrom) bounded by RELEASE_ASSERTs on span sizes.
🟡 watch PolicyBypass 0.3 low — Source/WebCore/loader 1b00bc4536dc blob/inherited document receiving wrong IP address space for Private Network Access classification
🟡 watch Race 0.3 low — Source/WebCore/loader 7e9466634388 CachedScript m_script/m_decoder/m_decodingState read on main thread without documented locking discipline while compilation threads read under lock.
🟡 watch PolicyBypass 0.3 medium — Source/WebCore/dom 944f82d72ae7 Local Network Access (RFC1918/PNA) control enforcing secure-context + permissions-policy + permission before public pages reach local/loopback addresses.
🟡 watch Race 0.3 low — Source/JavaScriptCore/ftl f2535d35a033 Assorted unguarded cross-thread field accesses (GC, JIT, media, storage) now lock-annotated or atomic
⚪ noise NotSecurity 0.2 low — Source/WebCore/history 3d1769871dc6 null localMainFrame deref during CachedPage::restore under site isolation
⚪ noise NotSecurity 0.2 low — Source/JavaScriptCore/bytecompiler 4fa7b55ae4c6 tail-call optimization incorrectly applied across an await in generator/async bodies
⚪ noise NotSecurity 0.2 low — Source/WebCore/html f2f5e1dff4dd n/a
⚪ noise NotSecurity 0.15 low — Source/WebCore/dom 2aedf51ba631 none
⚪ noise NotSecurity 0.15 low — Source/WebGPU/ 514f90daafbe none
⚪ noise NotSecurity 0.15 low — Source/WebCore/accessibility 6d28d6994a1f n/a
⚪ noise LogicError 0.15 low — Source/WebCore/animation 7b265b345c26 n/a
⚪ noise NotSecurity 0.15 low — Source/WebCore/platform 893cb75bec40 n/a
⚪ noise NotSecurity 0.15 low — Source/WebCore/rendering 8ff57ddb452a n/a
⚪ noise NotSecurity 0.15 low — Source/WebCore/dom 94f9b7905e3c n/a
⚪ noise NotSecurity 0.15 low — Source/WebCore/rendering cb5ef650091f n/a
⚪ noise NotSecurity 0.15 low — Source/WebKit/WebProcess d58d0a3ae2a0 n/a
⚪ noise NotSecurity 0.13 low — Source/WebCore/layout feb8e0dbf2cc none - refactor of how text-overflow/ellipsis style is resolved for anonymous inline/block boxes
⚪ noise NotSecurity 0.12 low — Source/WebCore/html 08004ec9ed57 none
⚪ noise NotSecurity 0.12 low — Source/WebCore/WebCore.xcodeproj 0db442413a5a none
⚪ noise NotSecurity 0.12 low — Source/WebCore/html 1a3eac178b9f none
⚪ noise NotSecurity 0.12 low — Source/WebCore/dom 3b068d9c3d5f none
⚪ noise NotSecurity 0.12 low — Source/JavaScriptCore/runtime b6afe0d39e0a n/a
⚪ noise NotSecurity 0.12 low — Source/WebCore/layout c0a49688cb18 n/a
⚪ noise NotSecurity 0.12 low — Source/WebCore/platform cd04e05d1a61 n/a
⚪ noise NotSecurity 0.12 low — Source/WebGPU/ d0eee3fe1ac2 n/a
⚪ noise NotSecurity 0.12 low — Source/WebCore/platform d95f64460bc6 n/a
⚪ noise NotSecurity 0.12 dev — Source/WTF/ fcef99916e4a none - protect()/RefPtr/WeakPtr SaferCPP hardening sweep plus toAPI(String) signature cleanup
⚪ noise NotSecurity 0.1 low — Source/WebCore/rendering 00af7a4b15fa none
⚪ noise NotSecurity 0.1 low — Source/WebCore/loader 0e84b2439008 none
⚪ noise NotSecurity 0.1 low — Source/WebCore/layout 3974cac991a4 none
⚪ noise NotSecurity 0.1 low — Source/WebCore/svg 3b9b086f6357 none
⚪ noise NotSecurity 0.1 low — Source/JavaScriptCore/b3 41ec81351b41 none
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/yarr 6279ebe3bd2d n/a
⚪ noise NotSecurity 0.1 dev — Source/WebCore/css 63354f38775d n/a
⚪ noise NotSecurity 0.1 low — Source/WebCore/html 7067ca63e913 n/a
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/bytecode 7bd7b6dfadc4 n/a
⚪ noise NotSecurity 0.1 dev — Source/ThirdParty/ANGLE/ 8a3192a38590 n/a
⚪ noise NotSecurity 0.1 dev — Source/WebCore/svg a6509b7967f0 n/a
⚪ noise NotSecurity 0.1 dev — Source/WebKit/UIProcess c0646476dd49 n/a
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/wasm c3a249e70753 n/a
⚪ noise NotSecurity 0.1 low — Source/WTF/ c4a7ebcc295f n/a
⚪ noise NotSecurity 0.1 low — Source/WebCore/html d6d0989dd597 n/a
⚪ noise NotSecurity 0.1 low — Source/JavaScriptCore/runtime df94b6ccbb53 n/a
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/llint e00002d2d87a n/a
⚪ noise NotSecurity 0.08 dev — Source/JavaScriptCore/runtime 00130dc2f37d none
⚪ noise NotSecurity 0.08 dev — Source/WTF/ 3e12766ced21 none
⚪ noise NotSecurity 0.08 low — Source/WTF/ 4b78955e0ded none
⚪ noise NotSecurity 0.08 dev — Source/WebCore/css edc74c3eeb03 n/a
⚪ noise NotSecurity 0.05 dev — Source/WebCore/css 051c3dbad0e7 none
⚪ noise NotSecurity 0.05 dev — Source/WebCore/css 0e801491f720 none