PatchGap

WebKit — 2026-W39

Clone-free silent-fix hunt over WebKit (GitHub-sourced), 2026-09-21 → 2026-09-27. Every candidate below is cherry-picked from the week’s merged Source/ commits, triaged on the patch-now / watch / noise ladder, given a full root-cause writeup, and put through independent adversarial verification — the same bar as the Chrome weekly reports.

This week. 144 candidates — 13 patch-now (RCE-class, attacker-reachable in default config), 14 watch (security-relevant but gated / weaker primitive / unproven), 117 noise, 0 duplicate. 9 root-caused · 9 tier-2 verified.

Candidates

Verdict: 🔴 patch-now (RCE-class, attacker-reachable in default config) · 🟡 watch (security-relevant but not confirmed patch-now — gated, weaker primitive, or unproven) · ⚪ noise (structural false positive) · 🔁 dup (cherry-pick). ✔︎verified = passed independent adversarial tier-2 review; ~plausible = tier-2 could not fully confirm from the diff. Conf is confidence the commit is a genuine security fix.

Verdict Class Conf Sev CVSS Component Commit Primitive
🔴 patch-now · ✔︎verified Spoofing 0.85 high — Source/WebKit/UIProcess 12024828ce4f compromised web process forges source SecurityOrigin in cross-process postMessageToRemote, bypassing origin checks
🔴 patch-now · ✔︎verified UAF 0.85 high — Source/WebGPU/ 37219708642e updateExternalTextures() mutating a BindGroup argument buffer still referenced by a live RenderBundle’s frozen residency snapshot
🔴 patch-now · ✔︎verified InfoDisclosure 0.85 high — Source/WebGPU/ 3e7224ef1acd texture marked previouslyCleared from a command buffer that is discarded/never committed, so lazy-clear is skipped and uninitialized GPU memory is later read
🔴 patch-now UAF 0.82 medium — Source/JavaScriptCore/inspector 04f7d4b2e3f8 FinalizationRegistry live/dead registration JSValues (target/heldValue/unregisterToken) unrooted during array construction -> GC collects them
🔴 patch-now · ✔︎verified OOB-write 0.82 high — Source/WebKit/GPUProcess 62b56128ec4b Unvalidated WebGPU mesh descriptor from web process -> out-of-bounds/overflowing geometry buffer sizing in GPU process
🔴 patch-now · ✔︎verified Race 0.82 high — Source/WebCore/platform 9d4cf39edf71 data race / UAF on AudioTrackPrivate & VideoTrackPrivate change callbacks invoked cross-thread
🔴 patch-now · ✔︎verified OOB-read 0.82 high — Source/WebGPU/ a778676fb20f stale draw-indexed validation cache reused while an index-buffer GPU write is pending -> out-of-bounds index/vertex fetch in GPU process
🔴 patch-now · ~plausible UAF 0.78 high — Source/WebCore/platform 14335b961fad FontRanges reference from fallbackRangesAt() dangles if FontCascadeFonts is replaced during fallback iteration
🔴 patch-now · ~plausible UAF 0.78 high — Source/WebCore/dom 56909e17f99a Blob URL revoked/freed while cross-process postMessage (MessagePort/BroadcastChannel/ServiceWorker) is in flight
🔴 patch-now Race 0.7 medium — Source/WebKit/WebProcess 5a3139cdf3e0 Data race / UAF on WebProcess::m_gpuProcessConnection RefPtr read off the main thread while main thread resets it
🔴 patch-now AuthorizationError 0.68 medium — Source/WebKit/NetworkProcess 6ed0b1c35498 Web process can supply a WebPageProxyIdentifier it does not own over IPC to the network process
🔴 patch-now InfoDisclosure 0.66 medium — Source/WebKit/UIProcess b1a58c0a3e7f missing frame-ownership check lets a web process read back/forward FrameState for a frame it does not host
🔴 patch-now UAF 0.65 medium — Source/WebCore/html 6576835764ea Dangling reference to primary-font FontMetrics after width() rebuilds the font cache in canvas measureText
🟡 watch · ~plausible LogicError 0.6 low — Source/WebGPU/ e854405c8003 use-after-move of captured dynamicOffsets Vector across RenderBundle replay in WebGPU RenderBundleEncoder setBindGroup
🟡 watch TypeConfusion 0.5 medium — Source/JavaScriptCore/wasm 03befd703d60 Wasm RTT/Projection allocated with non-compact malloc but referenced via CompactPtr that truncates/strips tags
🟡 watch InputValidation 0.5 medium — Source/WebCore/editing fea825bf5734 non-finite FloatSize from untrusted IPC reaching CoreText emoji strike (CTEmojiImageStrike alignmentInset)
🟡 watch UAF 0.45 low — Source/JavaScriptCore/debugger 7c0df54a0620 debugger retains dangling pointer to destroyed InspectorScriptProfilerAgent
🟡 watch Race 0.45 low — Source/WebCore/platform e0b1fddaa468 data race between thread-local GLContext/SkiaGLContext destructors and main-thread EGL display termination at process exit
🟡 watch UAF 0.4 medium — Source/WebCore/Modules 0db3c1ac8328 WebCodecs EncodedData/EncodedFrame held a raw std::span into chunk memory that could outlive the backing buffer across the async decode hop
🟡 watch IntegerOverflow 0.4 medium — Source/WebCore/Modules 2691eb67d877 WebCodecs AudioData buffer sizing - safeMultiply guard and exact CMBlockBuffer trim to described byte count
🟡 watch Race 0.4 medium — Source/WebKit/UIProcess 3d5f53ae2974 mouse-event queue stuck forever when a subframe process hangs/crashes or replies for a retired event
🟡 watch AuthorizationError 0.4 low — Source/WebKit/UIProcess d0321d4e6eec open-panel file sandbox extensions/approved-URLs granted to the wrong (main-frame) process under site isolation
🟡 watch PolicyBypass 0.4 medium — Source/WebCore/platform e01947d45058 web-process-chosen ProcessQualified ObjectIdentifier for GPU-process image-buffer transfer replaced by GPU-minted unguessable UUID
🟡 watch LogicError 0.35 medium — Source/WebCore/html 1bc64daa8a1b stale-option / null-renderer reentrancy in HTMLSelectElement::pickOrToggleOption after author script runs
🟡 watch UAF 0.33 low — Source/WebCore/inspector 054e73ac03d3 debugger detach leaves window-proxy global objects attached, stale Debugger<->JSGlobalObject association
🟡 watch InputValidation 0.3 low — Source/WebCore/inspector 2dbd6692e389 bounded IPC stack-trace (maxStackTraceLevels=1024, flat not linked-list) to avoid UIProcess stack exhaustion from WebContent
🟡 watch Spoofing 0.3 low — Source/WebKit/Shared bc9c8e1b2b04 stops trusting a renderer-supplied parentFrameID, deriving frame parentage from the UIProcess frame tree
⚪ noise LogicError 0.25 low — Source/WebCore/loader 4277592f79d3 subframe client-redirect with no current history item did not create a child item in the parent
⚪ noise IntegerOverflow 0.2 low — Source/WebKit/UIProcess 0dca5c74315b unchecked m_matchCount += matchCount in CountStringMatchesCallbackAggregator
⚪ noise LogicError 0.2 low — Source/WebCore/loader 2b7598eddbf2 none - PendingNavigateEventIdentifier to dispatch the navigate event before a cross-process swap
⚪ noise NotSecurity 0.2 low — Source/WebCore/rendering 7799f34a1444 scrolling-node lifecycle correctness (orphaned overflow-scroll proxy nodes)
⚪ noise NotSecurity 0.2 low — Source/WebCore/dom dfaf47f5fc32 none - touch-derived screenX/screenY mapped across site-isolated frames
⚪ noise NotSecurity 0.2 low — Source/WebKit/UIProcess ed22b31959e2 none - routes pasteboard IPC and pasteboard-access grant to the focused frame’s process under site isolation
⚪ noise NotSecurity 0.18 low — Source/WebGPU/ 2b37cc8a5a13 none - RenderBundle/RenderBundleEncoder store owned colorFormats/depthStencil/sampleCount instead of the WGPURenderBundleEncoderDescriptor struct
⚪ noise NotSecurity 0.18 low — Source/WebCore/page 8d3c0a9c276d detached RemoteDOMWindow origin reporting for cross-domain error message
⚪ noise Race 0.15 dev — Source/WebCore/platform 045f6aea552a none - threads a WorkQueue capability and adds assertIsCurrent/GUARDED_BY annotations to GPUVideoDecoderVTB
⚪ noise NotSecurity 0.15 low — Source/WebCore/dom 0ae01ce5e5bc none - introduces RefPtr-holding FrameAncestorIterator and migrates ancestor loops
⚪ noise NotSecurity 0.15 low — Source/WebKit/UIProcess 17704a72d6de none - extraction of frameContainingRange() helper for find-on-page IPC routing
⚪ noise NotSecurity 0.15 low — Source/WebCore/page 2a62dc2f4ea5 none - scrollbar hit-test reworked to collect hitTestableScrollbarLayers across all scrolling nodes
⚪ noise NotSecurity 0.15 low — Source/JavaScriptCore/bytecode 35637c643391 none - new op_iterator_close_check opcode and iterator-as-sentinel FastArray iteration mode
⚪ noise NotSecurity 0.15 low — Source/WebCore/dom 4b76c46dfef5 DataTransfer file-access policy refinement for GTK/WPE
⚪ noise NotSecurity 0.15 low — Source/WebCore/platform 4f8cb95d1c49 DMABuf Skia image init refactor; null GrContext guard
⚪ noise NotSecurity 0.15 low — Source/JavaScriptCore/runtime 653b77d5bddd Windows WASM/ArrayBuffer reserve-then-commit fast memory port
⚪ noise NotSecurity 0.15 low — Source/WebKit/NetworkProcess 8957ef7eaf3d none - cross-process postMessage/port ordering under site isolation
⚪ noise NotSecurity 0.15 low — Source/WebKit/UIProcess 99fe659f25c8 GTK snapshot/backing-store realize robustness (zero-size surface guard)
⚪ noise NotSecurity 0.15 low — Source/WebCore/rendering a703a4176178 none - clears stale needsLayout bits on skipped content
⚪ noise NotSecurity 0.15 low — Source/WebCore/loader c584246121e0 none - Navigation API navigate-event dispatch across process swap
⚪ noise NotSecurity 0.15 dev — Source/WebGPU/ e9c7ae85d4e6 none - replaces stored WGPURenderPipelineDescriptor (with self-referential member pointers) by extracted const value fields
⚪ noise NotSecurity 0.15 low — Source/WebKit/UIProcess f4bdbd8da761 none - tracks an attachment element’s owning web process for site-isolated icon/attribute updates
⚪ noise NotSecurity 0.15 low — Source/WebKit/WebProcess f6d7466ef3a8 none - computes selection overflow/frame clip rect and uses the local root view for cross-isolated-frame conversion on iOS
⚪ noise NotSecurity 0.15 low — Source/WebCore/html f83ad9a45599 none - implements Local Network Access permission-policy plumbing and query/testing hooks
⚪ noise NotSecurity 0.15 low — Source/WebKit/UIProcess fa42178e7969 none - changes WebBackForwardList currentItem/itemForID/findFrameStateInItem to return RefPtr instead of raw pointer
⚪ noise NotSecurity 0.15 dev — Source/WebCore/html ffa85990a685 none - migrates WebGL bufferData/bufferSubData from BufferDataSource Variant to BufferSource
⚪ noise NotSecurity 0.14 dev — Source/WebCore/html 02ffdaba68d4 none - notifies media/model parents on reparent
⚪ noise NotSecurity 0.13 dev — Source/JavaScriptCore/runtime 0506f92aff18 none - extends JSON transition cache fast path to 16-bit strings
⚪ noise NotSecurity 0.13 low — Source/JavaScriptCore/runtime 101392f63ca9 none - GC SlotVisitor ownership/analyzer plumbing refactor
⚪ noise NotSecurity 0.13 dev — Source/WebCore/page 149feb1b99db none - load-event ordering vs remote parent under site isolation
⚪ noise NotSecurity 0.13 low — Source/WebCore/platform 9467789fc16e none - compression dictionary transport (RFC9842) implementation
⚪ noise NotSecurity 0.13 low — Source/WebCore/dom eeb3a544b0f7 none - composed-tree hover/active ancestor tracking plus native select picker mouse-press handling
⚪ noise NotSecurity 0.12 dev — Source/WebCore/page 0f020dd66e35 none - contentsToMainFrameView coordinate conversion for site isolation
⚪ noise NotSecurity 0.12 dev — Source/WebCore/page 14db6c6baca8 none - threads pageZoomFactor/textZoomFactor through provisional frame creation
⚪ noise NotSecurity 0.12 low — Source/WebCore/loader 172f52ace994 none - re-architecture of tracking-prevention blocking onto a WebPrivacy content rule list
⚪ noise NotSecurity 0.12 low — Source/WebCore/editing 24695173a473 none - TextIndicator selectionRect coordinate-space rename root->mainFrame
⚪ noise NotSecurity 0.12 low — Source/WebCore/dom 2ce92dc302cd none - implements CanvasPaintEvent scheduling/dispatch feature
⚪ noise NotSecurity 0.12 low — Source/WebCore/html 2ee5c5840135 none - DataList elementRect coordinate rename + frame geometry/viewport sync plumbing
⚪ noise NotSecurity 0.12 low — Source/WebCore/loader 3f208b767511 none - FrameDescendantIterator/Range helpers replacing manual traverseNext loops
⚪ noise NotSecurity 0.12 low — Source/WebCore/dom 479d9f28f354 IntersectionObserver threshold re-sync on forced-Near proximity
⚪ noise NotSecurity 0.12 low — Source/WebKit/Shared 60b40e2770fb Cross-frame postMessage ordering preserved across async port-transfer hop
⚪ noise NotSecurity 0.12 low — Source/WebCore/html 6380911fcca7 CanvasImageSource IDL union reordering + Float32List->AllowSharedFloat32List rename
⚪ noise NotSecurity 0.12 low — Source/WebKit/NetworkProcess 6da13b652a6e IP address-space classification testing override
⚪ noise NotSecurity 0.12 dev — Source/JavaScriptCore/jit 778a559d303a none - wasm debugger MC-register plumbing / tail-call frame walk
⚪ noise NotSecurity 0.12 low — Source/WebKit/UIProcess 78c9cafc0c77 none - suspended-page process reuse under site isolation
⚪ noise NotSecurity 0.12 low — Source/WebKit/UIProcess 8411b9a97979 none - opener process-sharing policy under site isolation
⚪ noise NotSecurity 0.12 low — Source/WebCore/platform 891d1c8d9a92 none - Skia compositing filter-under-perspective rework
⚪ noise NotSecurity 0.12 low — Source/WebCore/loader 8de66dfab583 none - threading NavigationHistoryBehavior through process handoff
⚪ noise NotSecurity 0.12 low — Source/WebCore/page 92676a5875f4 none - clear hover/mouse state when pointer disappears on momentum scroll
⚪ noise NotSecurity 0.12 low — Source/WebCore/page a4ef371d3c80 none - drag/context-menu gesture state behavior
⚪ noise NotSecurity 0.12 low — Source/WebCore/layout ae2aca5d8313 none - CSS grid fit-content() space-distribution spec compliance
⚪ noise NotSecurity 0.1 dev — Source/WebCore/platform 038dda65d4bd none - Skia/TextureMapper compositing buffer refactor
⚪ noise NotSecurity 0.1 dev — Source/WebCore/html 03cc81b72b0c none - HTML-in-canvas render tree builder feature
⚪ noise NotSecurity 0.1 dev — Source/WebCore/css 041f3d27f174 none - CSS line-clamp/max-lines keyword grammar rework
⚪ noise NotSecurity 0.1 dev — Source/WebCore/platform 04735809c9ad none - rubber-band pin logic and automation gesture gating
⚪ noise NotSecurity 0.1 dev — Source/WebKit/UIProcess 09104a6e1e5d none - find-in-page cross-frame match index offset correctness
⚪ noise NotSecurity 0.1 dev — Source/WebCore/editing 0ed01cbc13ea none - new ViewportProximityInfo added to text manipulation
⚪ noise NotSecurity 0.1 dev — Source/WebCore/html 1623de98773e none - accessibility form-error-detection feature
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/b3 165f9ed4d013 none - CString -> ASCIICString/UTF8CString type-safety migration
⚪ noise NotSecurity 0.1 dev — Source/WebCore/html 16666484525a none - adds RGBA16 pixel format support
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/ftl 29a96fa5509b none - CString encoding type-safety refactor (UTF8CString/ASCIICString, protected ctors)
⚪ noise NotSecurity 0.1 low — Source/WebCore/layout 2bc9a21af50d none - grid layout repaint-if-moved and LayoutRepainter hoisting
⚪ noise NotSecurity 0.1 dev — Source/WebKit/NetworkProcess 2c0d28b35437 none - test-only IP address space override plumbing
⚪ noise NotSecurity 0.1 low — Source/WebCore/platform 2cc3c0c7e6f2 none - TextureMapper include reorg and AlphaMode/Origin parameterization for Skia/coordinated-graphics
⚪ noise NotSecurity 0.1 low — Source/WebCore/svg 352efb79ed61 none - SaferCPP protect() wrapping across SVG element/property code
⚪ noise NotSecurity 0.1 low — Source/WebCore/editing 36a3ac72aacb none - SaferCPP CheckedPtr/protect() migration across the editing subsystem
⚪ noise NotSecurity 0.1 low — Source/WebCore/loader 38cc1fbc76b8 none - SaferCPP protect() migration across loader/cache code
⚪ noise NotSecurity 0.1 low — Source/WebCore/rendering 38da305a284f none - isInResizeControl flag plumbed into InteractionInformationAtPosition for AppKit pan gestures
⚪ noise NotSecurity 0.1 low — Source/WebCore/html 486ead1df3a8 DateTimeChooser rect coordinate-space migration
⚪ noise NotSecurity 0.1 low — Source/WebCore/rendering 51ab3c3494d2 LayerOverlapMap recent-rect coverage fast path
⚪ noise NotSecurity 0.1 low — Source/WebCore/accessibility 568cf14ae6de Accessibility fieldset/legend LabelFor relation + ARIA-hidden label filtering
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/b3 58e02c19b9aa CString -> UTF8CString/ASCIICString/char8_t type migration
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/CMakeLists.txt 59be6c12449d GC Collector code split into Collector.cpp/CollectorInlines.h
⚪ noise NotSecurity 0.1 low — Source/WebCore/dom 5a1e7b740f38 AX_CUSTOM_COLOR_MODE controller plumbing + WebKitAdditions message splicing
⚪ noise NotSecurity 0.1 low — Source/WebCore/page 5f66068c2651 Drag start coordinate migration + WebViewImpl drag refactor
⚪ noise NotSecurity 0.1 low — Source/WebCore/editing 669358d70d3b SaferCPP protect()/RetainPtr hardening sweep
⚪ noise NotSecurity 0.1 low — Source/WebCore/editing 6d78c848600c Autocorrection panel rect coordinate migration
⚪ noise NotSecurity 0.1 low — Source/WebCore/html 701aa0c906ca SaferCPP RetainPtr/protect() hardening sweep across WebCore
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/API 71d5b30126aa JSRetainPtr -> RefPtr smart-pointer migration
⚪ noise NotSecurity 0.1 low — Source/WebCore/svg 73969fece772 AX_CUSTOM_COLOR_MODE SVG image inversion wiring
⚪ noise NotSecurity 0.1 dev — Source/WebKit/UIProcess 7498717ae81f none - site-isolation plumbing for position information
⚪ noise NotSecurity 0.1 dev — Source/JavaScriptCore/bytecode 7b485a76e9cc none - Reflect.construct bytecode fast path (new feature)
⚪ noise NotSecurity 0.1 dev — Source/WebCore/dom 877918e1be86 none - CheckedPtr nesting of renderer->layer() null check
⚪ noise NotSecurity 0.1 dev — Source/WebCore/Headers.cmake 92b20012526c none - WebCodecs transferable ArrayBuffer support (new feature)
⚪ noise NotSecurity 0.1 dev — Source/WebCore/css 9393f4ca085f none - restrict ::picker pseudo-element to single-line selects
⚪ noise NotSecurity 0.1 dev — Source/WebKit/UIProcess 98c5d805e403 none - site-isolation plumbing for selectPositionAtPoint
⚪ noise NotSecurity 0.1 dev — Source/WebCore/page 9bcf5840ef6d none - defer extension runtime message until SW activate finishes
⚪ noise NotSecurity 0.1 low — Source/JavaScriptCore/runtime b718c65267c6 none - JSON.parse fast-path optimization
⚪ noise NotSecurity 0.1 low — Source/WebCore/dom b904535e677c none - CachedScript -> CachedResource generalization
⚪ noise NotSecurity 0.1 low — Source/WebCore/rendering bf83909d56bd none - IntersectionObserver clip computation refactor
⚪ noise NotSecurity 0.1 low — Source/WebCore/rendering ce41a20021a1 none - text-control placeholder layer position update
⚪ noise NotSecurity 0.1 low — Source/WebCore/dom ce81c080a3d3 none - Automation interaction-location adjustment
⚪ noise NotSecurity 0.1 low — Source/WebCore/html d620932d8ce3 none - image sizing / CanvasImageSource usability refactor
⚪ noise NotSecurity 0.1 low — Source/WTF/ d9eaeec65476 none - new WebCore HEVC/H265 video decoder feature
⚪ noise NotSecurity 0.1 low — Source/JavaScriptCore/b3 d9fb479bd09e none - B3 always-run fixSSA pipeline cleanup
⚪ noise NotSecurity 0.1 low — Source/WebCore/html dd515af3c07b none - close select picker when element stops being a dropdown
⚪ noise NotSecurity 0.1 dev — Source/WebCore/html e594530ffc4e none - introduces the cross-process ImageBuffer transfer feature for postMessage of ImageBitmaps
⚪ noise NotSecurity 0.1 dev — Source/WebCore/bindings e5b8d50e1255 none - adds internal convertRectToMainFrameCoordinates API for autofill
⚪ noise NotSecurity 0.1 dev — Source/WebKit/CMakeLists.txt e7fcdaa2dc68 none - implements the WebExtension notifications.create() API
⚪ noise NotSecurity 0.1 dev — Source/WebCore/html efa134cb8c34 none - migrates drawImage() call sites to the drawBitmapImage() overload
⚪ noise NotSecurity 0.1 dev — Source/WebCore/dom f2468d106a0c none - adds AX_CUSTOM_COLOR_MODE text-backdrop paint phases
⚪ noise NotSecurity 0.1 dev — Source/WebCore/rendering f5a70c20fda9 none - clears stale needsLayout flags on skipped-content children in flex/grid layout
⚪ noise NotSecurity 0.1 dev — Source/WebKit/UIProcess ff835bfba1ac none - tracks WebDriver node references across process swaps to distinguish stale vs not-found
⚪ noise NotSecurity 0.08 dev — Source/WebCore/html 01d5ae3487df none - canvas drawElementImage/captureElementImage feature implementation
⚪ noise NotSecurity 0.08 dev — Source/WTF/ 5d43ab597d9f Read-write lock benchmark (LockSpeedTest/ToyLocks)
⚪ noise NotSecurity 0.08 dev — Source/WebCore/dom 73aa6c89e2cb none - SaferCPP lazyInitialize()/const field migration
⚪ noise NotSecurity 0.08 dev — Source/WebCore/dom 81b89faa3dd4 none - consolidation of lazy-load observers
⚪ noise NotSecurity 0.08 dev — Source/WebCore/rendering 8889b46654d9 none - spatial-portal position-anchor support (new feature)
⚪ noise NotSecurity 0.08 dev — Source/WebCore/Headers.cmake 8b235dbb0f82 none - H264 VideoToolbox encoder support (new feature)
⚪ noise NotSecurity 0.08 dev — Source/JavaScriptCore/CMakeLists.txt 9cf419e5c4ba none - Corpse crash-inspection memory-reading library (new tooling)
⚪ noise NotSecurity 0.08 dev — Source/WebCore/platform bb75cbc00030 none - TextureMapper CoordinatedGraphics file reorganization
⚪ noise NotSecurity 0.08 dev — Source/JavaScriptCore/CMakeLists.txt c2fa19276047 none - JSC Heap/Collector class split
⚪ noise NotSecurity 0.08 dev — Source/WebCore/Modules/mediastream ce1fa925b83a none - const-member / lazyInitialize hardening refactor
⚪ noise NotSecurity 0.05 dev — Source/WebCore/css 9e7af1080e15 none - new @environment-map CSS rule feature
⚪ noise NotSecurity 0.05 dev — Source/JavaScriptCore/runtime a749c7f86473 none - NODELETE/SUPPRESS_NODELETE annotations + SaferCPP expectations
⚪ noise NotSecurity 0.05 dev — Source/ThirdParty/skia b6d8d019a21a none - Skia third-party dependency roll
⚪ noise NotSecurity 0.05 dev — Source/WebCore/css c150a5007f05 none - CSS corner/corner-* shorthands feature